---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security
Release :
- australia
ft:locale :
- de-DE
ft:publication_title :
- Australia Platform security
ft:clusterId :
- psec
bundleId :
- psec
workflow :
- Platform
---
# Restrict unauthenticated access to attachments
# Restrict unauthenticated access to attachments {#ariaid-title1}
* Freigeben Version: Australia
*
* Aktualisiert 12. März 2026
*
*  2 Minuten Lesedauer
Restrict unauthenticated access to image attachments using a system property.
Use the glide.image_provider.security_enabled property restrict unauthenticated access to image attachments. If set to true, images are visible to any authenticated user but no
unauthenticated user. If set to false, images are visible to anyone with a URL to the attachment. Thumbnails of an attached image maintain the same policy as the original attached image and are accessible
to the same set of users as the original attached image. When this property is enabled, more fine grained access control for unauthenticated users is obtained through entries in the Security Allow/Deny List Entities
\[sys_security_restricted_list\] table and through the declaration of public KB articles for those images attached to KB articles. These exceptions to the default policy for unauthenticated users when this property is
true are applied in the following order.
Hinweis:
In these exceptions, "parent table" refers to the table of the original image attachment from which a thumbnail is generated.
1. If the table of an attached image or parent table of a thumbnail image is deny-listed in the Security Allow/Deny List Entities \[sys_security_restricted_list\] table, access is denied to the image/thumbnail.
2. If the table of an attached image or parent table of a thumbnail image is allow-listed in the Security Allow/Deny List Entities \[sys_security_restricted_list\] table, access is granted to the image/thumbnail.
3. If the table of an attached image or parent table of a thumbnail image is included in a public KB article, access is granted to the image/thumbnail.
{#sc-restrict-unauthenticated-access-attachments__ol_dcd_yzm_yhc}
Ensure that the property glide.image_provider.security_enabled is set to true. If the property does not exist on the System Properties \[sys_properties\] table, the default value is
false.
## More information {#sc-restrict-unauthenticated-access-attachments__section_more_information}
{#sc-restrict-unauthenticated-access-attachments__table_ajc_b43_3kb__entry__2}
| Attribute | Description |
|-|-|
| Property name | glide.image_provider.security_enabled |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Access control](https://servicenow-prod.fluidtopics.net/xAmazkRh5FKyeb7q4TQGWw "The access control category audits the process of protecting resources from unauthorized access through granting and denying requests based on a permission model. This includes ensuring an entity accessing a resource holds valid credentials to do so, creating and protecting a well-defined set of roles or permissions and ensuring role or permission controls are protected from replay and tampering.") |
| Recommended value | true |
| Default value | false |
| Fallback value | false |
| Functional impact | If the property was previously false and then is set to true, unauthenticated users can no longer be able to access image attachments unless explicitly allowed using one of the exclusion procedures. |
| Security risk | * Severity Score: 6.5 * CVSS Rating: Medium * Security Risk Details: If the property is set to false, image attachments are visible to anyone authenticated or unauthenticated with a URL to the attachment. This may lead to sensitive information leaks. To avoid these, set the property to true and ensure any exceptions to the default policy when the property is true are properly configured. {#sc-restrict-unauthenticated-access-attachments__ul_nvy_fhs_mfc} |
| References | [Administering attachments](https://www.servicenow.com/docs/access?context=r_AdministeringAttachments&version=australia&pubname=australia-platform-administration&ft:locale=en-US) [Available system properties](https://www.servicenow.com/docs/access?context=r_AvailableSystemProperties&version=australia&pubname=australia-platform-administration&ft:locale=en-US) |
[ ]
{#sc-restrict-unauthenticated-access-attachments__table_ajc_b43_3kb}
To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).