---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Security settings properties

# Security settings properties {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 Minuten Lesedauer

Security settings provide several properties to control the level of security on your instance.{#r_GeneralSecuritySettings__props-desc}
There are several ways to set or change general security settings properties.

* Navigate to System PropertiesSecurity.

  Options on the Security page are Yes or
  No.
* Navigate to the sys_properties.list and search for the property you want to set or change.

  Options in the System Properties table
  \[sys_properties.list\] are true or
  false.
* Navigate to System SecurityInstance Security Center, then click Hardening.

  You can configure the settings for the most important and critical security properties. The Instance Security Hardening Settings content contains detailed descriptions, and compliance values, for the security-related system properties and plugins in the ServiceNow AI Platform. To learn more about each of these properties, see [Hardening settings](https://servicenow-prod.fluidtopics.net/RXuZVYITUAWpGv29FS1iKg "The ServiceNow Security Center (SSC) hardening settings content contains detailed descriptions and compliance values for the security-related system properties and plugins in the ServiceNow AI Platform. You can set these properties using the hardening settings app in the Security Center.").
{#r_GeneralSecuritySettings__ul_uck_d3j_tbb}  
Warnung:  
When implementing any of these security features, you must thoroughly test the features before you deploy them in a production instance.

## Escaping and embedded script support {#r_GeneralSecuritySettings__section_j2q_y3v_g3b}

|-|-|
| glide.ui.security.allow_codetag | Supports embedding HTML code using the \[code\] tag. Default value: Yes Hinweis: Instance Security Hardening Settings: [Disable embedded HTML code \[Updated in Security Center 1.3\]](buCRojPrL6aTxOCL1L4tlQ "Use the glide.ui.security.allow_codetag property to disable support for embedding HTML code created using the [code] tag.") |
| glide.ui.security.codetag.allow_script | Allows embedded HTML (using \[code\] tags) to contain Javascript tags. Hinweis: This property is set to true by default in Vancouver and later releases, and can't be changed by administrators. For a use case where the property has to be changed, contact customer support. For more information see [Disable JavaScript tags in embedded HTML \[Updated in Security Center 1.3\]](rm3MDx1z7ZI32jZx2MZ8og "Use the glide.ui.security.codetag.allow_script property to disable support for embedding HTML JavaScript code created using of the [code] tag."). |
| glide.ui.escape_all_script | Forces all expressions within Jelly JavaScript `<script type="text/javascript">` tags to be escaped by default. Enforces escaping only if the type attribute in the `<script>` tag is empty, or if the value is `text/javascript`, `text/ecmascript`, `application/javascript`, `application/ecmascript`, or `application/x-javascript`. * Default value: * New/zbooted instances: true * Upgraded instances: false {#r_GeneralSecuritySettings__ul_bsh_jkp_lgb} * Recommended value: Yes {#r_GeneralSecuritySettings__ul_nb5_3kp_lgb} Hinweis: Instance Security Hardening Settings: [Escape jelly script \[Updated in Security Center 1.3 and 1.5\]](1Sr0HpOv_ulGo9FNu4VPYw "Use the glide.ui.escape_all_script property to force escape of all scripts injected into Jelly.") |
[ ]

{#r_GeneralSecuritySettings__table_n4d_yck_nsb}

## Attachment limits and behavior {#r_GeneralSecuritySettings__section_lpv_2jv_g3b}

|-|-|
| com.glide.attachment.max_size | Sets the maximum file attachment size in megabytes. |
| glide.attachment.role | Lists the roles (comma-separated) that can create attachments. |
| glide.attachment.extensions | Lists the file extensions (comma-separated) that can be attached to documents via the attachment dialog. Extensions should not include the dot (.). For example, xls, xlsx, doc, docx. Leave blank to allow all extensions. Hinweis: Instance Security Hardening Settings: [File and resources](https://servicenow-prod.fluidtopics.net/5~TKzbBqQIVPVFIiiTAcxg "The file and resources category ensures applications handle untrusted file data securely and store untrusted data from untrusted sources with limited permissions in an appropriate location.") |
| glide.ui.attachment.force_download_all_mime_types | Forces download of all multipurpose internet mail extensions (MIME) type attachment files. Default value: * New/zbooted instances: Yes * Upgraded instances: No {#r_GeneralSecuritySettings__ul_pdk_mkp_lgb} Hinweis: Instance Security Hardening Settings: [Set Allowed MIME Child Types \[New in Security Center 2.0\]](TSVwLo~Fg8xLIk4n9inn8A "Learn how to configure the glide.security.mime.type.allowed_child_types property to a secure setting so that file types will not pass the Multipurpose Internet Mail Extensions (MIME) type checking. This reduces the risk of remote code execution on an uploaded file.") |
| glide.security.file.mime_type.validation | Enables (Yes) or disables (No) MIME type validation for file attachments. File extensions configured via glide.attachment.extensions are checked for MIME type during upload. Default value: * New/zbooted instances: Yes * Upgraded instances: No {#r_GeneralSecuritySettings__ul_azf_fmp_lgb} Hinweis: Instance Security Hardening Settings: [Restrict uploaded MIME types \[Updated in Security Center 1.3 and 2.0\]](E0LVZJQo1D39SdL4amow~w "Use the glide.security.file.mime_type.validation property to activate MIME type checking for uploads. You can enable (set the property to true) or disable (set it to false) MIME type validation for file attachments.") |
[ ]

{#r_GeneralSecuritySettings__table_yzb_ddk_nsb}

## Customer uploads {#r_GeneralSecuritySettings__section_azs_4jv_g3b}

These properties affect customer uploads only. They do not affect attachments.

|-|-|
| glide.ui.strict_customer_uploaded_static_content | When you set this property to Yes, turns on the ability to restrict the types of files that can be downloaded, when they have been uploaded using the Upload File functionality of the ServiceNow AI Platform. Used with glide.ui.strict_customer_uploaded_content_types Hinweis: Instance Security Hardening Settings: [Restrict downloadable files types in static content \[Updated in Security Center 1.3\]](uFL0zwk3Aa57q6W9wjFHmQ "Use the glide.ui.strict_customer_uploaded_static_content property to enable restrictions on the file types that can be downloaded when they have been uploaded using the Upload File functionality.") |
| glide.ui.strict_customer_uploaded_content_types | When this parameter includes a list of comma-delimited file types, of the files that were uploaded using the Upload File functionality of the ServiceNow AI Platform, only these file types can be downloaded from the instance. Hinweis: Instance Security Hardening Settings: [Restrict downloadable files types in static content \[Updated in Security Center 1.3\]](uFL0zwk3Aa57q6W9wjFHmQ "Use the glide.ui.strict_customer_uploaded_static_content property to enable restrictions on the file types that can be downloaded when they have been uploaded using the Upload File functionality.") |
[ ]

{#r_GeneralSecuritySettings__table_m5l_ydk_nsb}

## Security Manager and options {#r_GeneralSecuritySettings__section_skv_vjv_g3b}

|-|-|
| glide.security.manager | Security Manager. |
| glide.sm.default_mode | Security manager default behavior in the absence of any ACLs on a table. |
| glide.security.strict.updates | Double-checks security on inbound transactions during form submission. Rights are always checked on form generation. Hinweis: This property is set to true by default, and can't be changed by administrators. For a use case where the property has to be changed, contact customer support. For more information see [Double check inbound transactions \[Updated in Security Center 1.3\]](z9HdVYcpyBgOiZJ~tD4Y7w "Use the glide.security.strict.updates property to enable double-checking of security on inbound transactions during form submission. When you set this property to true, it adds an extra layer of table validation before a form renders in the browser."). |
| glide.security.strict.actions | Checks conditions on UI actions before execution. Normally, conditions are checked only during form rendering. Hinweis: Instance Security Hardening Settings: [Check UI action conditions before execution](https://servicenow-prod.fluidtopics.net/QeEd21E6qrFitL0oWR7qCg "Use the glide.security.strict.actions property to enable checking of UI actions conditions in forms and lists before they execute. When you set this property to true, it adds an extra layer of validation on the table UI actions before they are executed.") |
| glide.security.granular.create | Enforces the create rules on new records (as opposed to the write rules, which may include creating and updating). |
| glide.security.explain.write.locks | Displays an explanation on locked form elements. |
[ ]

{#r_GeneralSecuritySettings__table_lkq_f2k_nsb}

## Cookies {#r_GeneralSecuritySettings__section_s4m_gkv_g3b}

|-|-|
| glide.ui.forgetme | Removes the Remember me check box from the login page when the instance is using either LDAP or DB logins. User's active logged in sessions are timed out after X minutes of inactivity, where X is the value of the glide.ui.session_timeout system property. Default value: Yes (New and Z-Booted instances Hinweis: Instance Security Hardening Settings: [Remove remember me](https://servicenow-prod.fluidtopics.net/GAdtT8NCchlEuQbbGKmHCw "Use the glide.ui.forgetme property to remove the Remember Me check box from the login page to prevent login information from being cached.") |
| glide.ui.secure_cookies | Enables secure session cookies to enforce additional cookie security. If Yes, strict session cookie validation is enforced. With version 3 cookies enabled, additional security requirements are also enforced. Hinweis: Instance Security Hardening Settings: [Enforce strict security of session cookies \[Updated in Security Center 1.3\]](vxtGTLSyONiJVlH7YOJpLA "Use the glide.ui.secure_cookies property to require properly formatted cookies") |
| glide.secure_cookie.debug | Secure session cookie debugging. Select to enable extensive debug logging of secure session cookie operations. |
[ ]

{#r_GeneralSecuritySettings__table_ejs_42k_nsb}

## Security restrictions for execution of scripts originating from the client {#r_GeneralSecuritySettings__section_wsv_pkv_g3b}

|-|-|
| glide.script.use.sandbox | Run client-generated scripts (AJAXEvaluate and query conditions) inside a reduced-rights sandbox. If enabled, only those business rules and script includes with the Client callable check box selected are available, and certain back-end application programming interface (API) calls are disallowed. Hinweis: Instance Security Hardening Settings: [Enable script sandbox \[Updated in Security Center 1.3\]](CsRxA2~Phac7xbCXVyY3BQ "Use the glide.script.use.sandbox property to enable script sandboxing.") |
| glide.script.allow.ajaxevaluate | Enables the AJAXEvaluate processor. Hinweis: Instance Security Hardening Settings: [Disable AJAXEvaluate](https://servicenow-prod.fluidtopics.net/oF4JD9yBCmjSuJHfy6sPxQ "Use the glide.script.allow.ajaxevaluate to protect the system API from vulnerabilities of Client script execution through AJAX calls.") |
| glide.script.secure.ajaxgliderecord | Applies standard security access control lists (ACLs) to AJAXGlideRecord calls. Default Value: Yes, for new and upgraded instances. (If Yes, cannot be changed to No.) Hinweis: Instance Security Hardening Settings: [Require AJAXGlideRecord ACL checking \[Updated in Security Center 1.3\]](eqDY710a7RVDCnZmLnUuDw "Use the glide.script.secure.ajaxgliderecord property to perform access control rule (ACL) validation when server-side records, such as tables, are accessed using GlideAjax APIs within a client script.") |
[ ]

{#r_GeneralSecuritySettings__table_avt_bfk_nsb}

## Miscellaneous {#r_GeneralSecuritySettings__section_jpt_wkv_g3b}

|-|-|
| com.glide.communications.trustmanager_trust_all | By default, the instance trusts a certificate's Certificate Authority (CA). Ensures that the instance accepts self-issued certificates. To validate a certificate's CA, set this property to No Instance Security Hardening Settings: [Enforce certificate trust \[Updated in Security Center 1.3, removed in 2.0, added in 7.0\]](Cx1dyxQIyLlkzrCjBnFWiw "Use system properties to ensure that certificate expiration and trust are checked for certificates received from outbound HTTPS call endpoints when host verification is not performed.") |
| glide.outbound.sslv3.disabled | When active, forces outbound connections from an instance to use the transport layer security (TLS) instead of the secure sockets layer (SSL). Instance Security Hardening Settings: [Disable outbound SSLv2/SSLv3 connections \[Updated in Security Center 1.3\]](_rn5yvFk_YGCD1WRLqXG9g "Use the glide.outbound.sslv3.disabled property to force the MID Server to use TLS when making outbound connections, such as REST and SOAP requests. Normally, outbound connections from an instance are forced to use TLS instead of SSL.") Wichtig: The value for this property is a safe override and cannot be altered once changed. |
[ ]

{#r_GeneralSecuritySettings__table_krc_mfk_nsb} Additional properties are available for [High Security Settings](https://servicenow-prod.fluidtopics.net/f8gVxeeTKuTUbGIE_Ua8hw "High Security Settings refer to several security options available in your instance.").