---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Restrict oauth parameters to POST body \[New in Security Center 1.3\]

# Restrict oauth parameters to POST body \[New in Security Center 1.3\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.oauth.allow.parameters.in.post.body.only property to control the inbound OAuth authentication's acceptance of access tokens. Access tokens are sensitive and should only be accepted when
located within a POST request body.

## More information {#sc-restrict-oauth-parameters-to-post-body__section_qhx_1b1_xwb}

{#sc-restrict-oauth-parameters-to-post-body__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.oauth.allow.parameters.in.post.body.only |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Category | [Data protection](https://servicenow-prod.fluidtopics.net/kKCcomLoCJcv2UycJegJgw "The data protection category addresses the elements of confidentiality, integrity and availability (CIA) of data.") |
| Security risk | * Severity score: 4.2 * CVSS score: Medium * Security risk details: If glide.oauth.allow.parameters.in.post.body.only isn't set to the recommended value of true, access tokens could be present in the GET request parameter. These access tokens could linger in client and infrastructure logs and potentially lead to account takeover if those logs are leaked. {#sc-restrict-oauth-parameters-to-post-body__ul_g1g_3sf_xwb} |
| Dependencies and prerequisites | None |
| References | * [OAuth 2.0](https://servicenow-prod.fluidtopics.net/5DnYhXA~0m_~A5N41qDq8A "OAuth 2.0 lets users access instance resources through external clients by obtaining a token rather than by entering login credentials with each resource request.") * [Manage OAuth tokens](https://servicenow-prod.fluidtopics.net/9qNzSATjAptXitCN_xQy~w "Open OAuth tokens to provide access to restricted resources.") {#sc-restrict-oauth-parameters-to-post-body__ul_sqb_nnp_myb} |
| Functional impact | Ensures that oauth_token.do processor accepts only POST body parameters as input for all supported grant types. |
[ ]

{#sc-restrict-oauth-parameters-to-post-body__table_ajc_b43_3kb}