Property reference

`glide.security.csrf.httpauth_processor_allowlist`

The glide.security.csrf.httpauth_processor_allowlist property defines a list of processors that are exempt from Cross-Site Request Forgery (CSRF) enforcement. Admins should review this property to ensure that only trusted processors are allowed to bypass CSRF checks, maintaining system security.

Default: Not set
Type: string
Application: Global

Key questions about this property

The answers below summarize the purpose, scope, default effect, and review scenarios for this property.

What does it do?	This property allows specified processors to bypass CSRF enforcement when the broader CSRF checks for authenticated requests are enabled, preventing HTTP 401 rejections for those processors.
What area does it affect?	CSRF Security Enforcement
What does the default mean?	No default value is documented in this property record.
When should you review it?	Review this property when configuring CSRF protection for authenticated processors or when adding new processors.

Out of the box property record

Raw metadata from the property record.

Property name	`glide.security.csrf.httpauth_processor_allowlist`
Sys ID	`ccf661d3ff000310b612ffffffffff82`
Type	string
Application	Global
Default value	Not set
Description	Comma-separated list of Processors exempt from CSRF enforcement. Processors should use the require_csrf flag instead. Example: JSONv2Processor,ImportProcessor
Updated	2026-03-24 00:00:00

Sources

Official references and nearby text excerpts where this property appears.

Brazil docs View supporting context

Context preview Snippet 1

... request is rejected with an HTTP 401 response. Rejection details are logged. This enforcement applies to POST, PUT, and DELETE requests. GET requests are allowed without a CSRF token. The glide.security.csrf.httpauth_processor_allowlist property controls an exception list that allows specific processors extending HTTPAuthProcessor to bypass CSRF enforcement. When glide.security.csrf.processor.all.authenticated.enabled is active, requests to processors named in this allow-list bypass the HTTP 401 ...

More in `glide.security`

Other properties in the same namespace.

glide.security.3des.suspension_date This property records the timestamp for when the 3DES key removal job was paused, impacting key management pro glide.security.acl_with_invalid_roles_strict_deny This property enforces strict denial of access for ACLs that reference only deleted or non-existent roles, pre glide.security.admin.override.accessterm This property, when set to true, ensures that the admin overridable condition is assessed specifically at the glide.security.attachment_type.use_blacklist This property enables or disables the validation of file attachments against defined exclusion lists to enhanc glide.security.csrf.processor.all.authenticated.logging_enabled It activates logging for Cross-Site Request Forgery violations in authenticated sessions, helping to track pot glide.security.csrf.rest.public_csrf.enabled This property enforces CSRF token validation for public REST API requests, requiring a valid token to prevent glide.security.csrf.strict.validation.mode This property determines whether strict validation of CSRF tokens is enforced, blocking requests with mismatch glide.security.csrf_previous.allow This property allows expired secure tokens to be used for request validation, impacting CSRF protection mechan

All 50 properties in glide.security →