Property reference

`glide.oauth.clients.allowed.for.implicit.grant`

The glide.oauth.clients.allowed.for.implicit.grant property specifies which OAuth clients are permitted to use the implicit grant type. Admins should review this setting to prevent potential security vulnerabilities associated with access token leakage in client-side applications.

Default: Not stated
Type: Not stated
Application: Not stated

Key questions about this property

The answers below summarize the purpose, scope, default effect, and review scenarios for this property.

What does it do?	This property allows specified OAuth clients to utilize the implicit grant type, which is generally discouraged due to security risks.
What area does it affect?	OAuth Client Configuration
What does the default mean?	No default value is stated in the ServiceNow documentation.
When should you review it?	Review this property when configuring OAuth clients or assessing security risks in your application.

Property record

Facts stated in the ServiceNow documentation. No out of the box record has been read from an instance yet.

Property name	`glide.oauth.clients.allowed.for.implicit.grant`
Type	Not stated
Application	Not stated
Default value	Not stated
Description	Not stated

Sources

Official references and nearby text excerpts where this property appears.

Brazil docs View supporting context

Context preview Snippet 1

... OAuth access token. Since CORS support is universal, OAuth clients don’t need to use the implicit grant, and implicit grant type requests fail by default. Client IDs listed in the glide.oauth.clients.allowed.for.implicit.grant property can continue using the implicit grant type. Ensure that the property doesn’t exist in the System Properties [sys_properties] table, or exists but doesn’t contain a value. Important: Changing an ...

More in `glide.oauth`

Other properties in the same namespace.

glide.oauth.allow.parameters.in.post.body.only This property enforces the use of POST body parameters exclusively for OAuth token requests, enhancing securit glide.oauth.block_websvc_session_for_ui This property, when set to true, blocks web service sessions from being used in the user interface, thereby re glide.oauth.cors.allowed.origin This property defines which domains are permitted to make cross-origin requests to ServiceNow's OAuth endpoint glide.oauth.enable.jwt.requester_id This property determines whether the requester ID is considered when generating JWT tokens, affecting the secu glide.oauth.enforce_restricted_binding_for_ui This property ensures that access tokens generated for OAuth entities cannot be used for UI interactions, enha glide.oauth.entity_profile_denylist This property defines which oauth_entity_profiles prevent admins from viewing the 'Token received' field, enha glide.oauth.inbound.client.credential.grant_type.enabled This property allows the use of the client credentials grant type for OAuth inbound integrations, enhancing se glide.oauth.inbound.ropc.grant_type.disabled This property controls whether the resource owner password credentials grant type is allowed for inbound OAuth

All 24 properties in glide.oauth →