---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Rotate HTTP session identifiers

# Rotate HTTP session identifiers {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.ui.rotate_sessions property to enable rotation of
the HTTP session identifiers to reduce security vulnerabilities.
If an unauthenticated user's session ID doesn't change after authentication, a web
application is vulnerable to a [session fixation attack](https://www.owasp.org/index.php/Session_fixation). A malicious user could
start an unauthenticated session and give the associated session ID to the victim. Once the
victim authenticates, the malicious user now shares that authenticated session.

## More information {#sc-rotate-http-session-identifiers__section_more_information}

{#sc-rotate-http-session-identifiers__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.ui.rotate_sessions |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Session management](https://servicenow-prod.fluidtopics.net/VAFB7gAR3D02VvnVYJ_a3g "This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.") |
| Purpose | To achieve more secure session authentication. |
| Recommended value | true |
| Default value | true |
| Security risk rating | 8.8 |
| Functional impact | This remediation modified the SessionID when user navigates from unauthenticated page to authenticated pages. * If you are using a proxy or hardcoding the SessionID when a user first logs in, or for any purpose, then there can be a potential functionality impact. * If you are using the SAML 2.0 plugin for Single Sign-on authentication, it might interfere with the session information sharing between the instance and the Identity Provider. In such case, you can set this property to false. {#sc-rotate-http-session-identifiers__ul_zjl_llp_pkb} |
| Security risk | (Moderate) SessionID is used to process and authenticate the instance user by maintaining the session state on the browser. Thus, SessionID is deemed as sensitive data and should be secure by default. Session Rotation is a security control that enforces the alteration of sessionID whenever the user navigates from unauthenticated pages to authenticate pages. |
| References | [Authentication with SAML](https://servicenow-prod.fluidtopics.net/oU_wK6m08Nu~IartngzdzA "The Security Assertion Markup Language (SAML) is an XML-based standard for exchanging authentication and authorization data between security domains.") |
[ ]

{#sc-rotate-http-session-identifiers__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).