---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Session management

# Session management {#ariaid-title1}

This category looks at the security of the application state for a user. Sessions should be unique to each individual, unable to be guessed or shared, and invalidated after periods of inactivity or when not required. This
includes factors such as cookie attributes for cookie-based sessions, session token generation, and storage and requirements for federated re-authentication.
* **[Apply continuous authentication policies to mobile sessions](https://servicenow-prod.fluidtopics.net/exGxJuWlvriWSRUsszEUPQ)**   
  Reduce the risk of session hijacking by applying continuous authentication policies to mobile sessions.
* **[Minimize absolute session timeout duration \[Updated in Security Center 1.3\]](RqPQg~i7GfJ2WH6~lF00Xw)**   
  Use the glide.ui.user_cookie.max_life_span_in_days property to set a maximum life span for user cookies created when users log in with the Remember Me checkbox selected. When the cookie expires, users who have selected the Remember Me checkbox are forced to reauthenticate into the instance.
* **[Define active session timeout exception roles \[New in Security Center 1.3\]](MiBnhI0yvtF2GYdPngA1VQ)**   
  Use a system property to exempt roles from active session timeout limits.
* **[Enable UserCookie version 3.1 \[Updated in Security Center 2.0\]](5y7WMwx4RLiMGDoAEHK9wg)**   
  Manage the version of UserCookie that is enabled on your instance to secure the storage of the secret key in the source code.
* **[Enforce password reset on api requests \[Updated in Security Center 1.5\]](0S0cnnARJrHaQOu4vuDrNw)**   
  Manage how the password reset functionality operates on your instance.
* **[Enable HTTP Only Cookie Flag \[Updated in Security Center 1.3\]](uyoM04pD_PDZVCMtvnaQ6w)**   
  Use the glide.cookies.http_only property to enable the HTTPOnly attribute for sensitive cookies.
* **[Invalidate Session After OAuth Token Expiration \[New in Security Center 2.0\]](rudrPbJ5NIKyy6N_trrMtA)**   
  Use a system property to the secure value to prevent users from continuing to use a session via cookies after the OAuth token used to create the session expires.
* **[Minimize concurrent interactive session quantity \[Updated in Security Center 1.3\]](8p9wOUKayc0NjT0Y13UwkA)**   
  Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user.
* **[Limit concurrent sessions across all nodes \[Updated in Security Center 1.3\]](BCqulYEEl~wPr8SP9POchA)**   
  Use the glide.authenticate.limit.concurrent.sessions.across.all.nodes property with the Limit Concurrent Sessions plugin to manage the number of sessions tracked across all nodes.
* **[Limit concurrent sessions plugin](https://servicenow-prod.fluidtopics.net/FMzWjeklyC70~cnXATqj7g)**   
  Configure the com.glide.limit.concurrent.sessions plugin to reduce the chance of session hijacking on your instance.
* **[Limit guest's active session life span \[New in Security Center 1.3\]](DPHxp1WJGyO3WCVkhlf9kA)**   
  Use the glide.guest.active.session.life_span property to control the duration of an active guest's HTTP sessions.
* **[Limit concurrent interactive sessions \[Updated in Security Center 1.3\]](Wa5sknhq8LSazqa0Z5kHSw)**   
  Manage the number of interactive sessions on your instance.
* **[Limit integrations' active session life span \[New in Security Center 1.3\]](EGm9ezCSGjUivagnO0VVoQ)**   
  The glide.integrations.active.session.life_span property enforces max lifespan on active guest HTTP sessions irrespective of inactive timeout. The configured value is in minutes. A value of zero will disable timing out the active sessions.
* **[Limit policy based session access mobile refresh token interval \[New in Security Center 1.5\]](uayEgKDXGjaNURXqn7tQfQ)**   
  Use the glide.authenticate.session_access.mobile.refresh_token_interval property to govern the length of time that must elapse before a mobile device user will be forced to re-authenticate.
* **[Limit UI active session life span \[New in Security Center 1.3\]](7kzqZF1mnH1C05F8aCMTzA)**   
  The glide.ui.active.session.life_span property enforces max lifespan on active authenticated HTTP sessions irrespective of inactive timeout.
* **[Limit session length for high assurance sessions](https://servicenow-prod.fluidtopics.net/wd0S4vi3A9lacO_zX6d4NQ)**   
  Reduce the risk of account takeover in high assurance sessions by limiting session length
* **[Proactively Invalidate Sessions After Defined Durations](https://servicenow-prod.fluidtopics.net/yjdAFqeeT1NA7yvITLA8Lg)**   
  The glide.active.session.timeout.invalidate.session property controls whether a timeout session is proactively invalidated before the Tomcat server.
* **[Rotate HTTP session identifiers](https://servicenow-prod.fluidtopics.net/sf~4o5~9mXP43bdKKVFcrQ)**   
  Use the glide.ui.rotate_sessions property to enable rotation of the HTTP session identifiers to reduce security vulnerabilities.
* **[Minimize concurrent interactive session quantity \[Updated in Security Center 1.3\]](7EP4gvsd2I4XI~zTHCp7aQ)**   
  Use this property with the Limit Concurrent Sessions plugin to control the number of active sessions that can be opened by a user.
* **[Minimize session activity timeout duration \[Updated in Security Center 1.3\]](kELWktvNlrONFdFZHrFIzQ)**   
  Use the glide.ui.session_timeout property to designate, in minutes, activity timeout value.
* **[Minimize session window timeout duration \[Updated in Security Center 1.3\]](HUOlkNXWOC6cptSBvKUIig)**   
  Use the glide.ui.user_cookie.life_span_in_days property to set the expiration time period for the Remember Me cookie. The default value is 15 days and the maximum cap is at 30 days.