Property reference

`glide.security.csrf.httpauth_processor_allowlist`

The glide.security.csrf.httpauth_processor_allowlist property defines a list of processors that are exempt from Cross-Site Request Forgery (CSRF) enforcement. Admins should review this property to ensure that only trusted processors are allowed to bypass CSRF checks, maintaining system security.

Default: Not set
Type: string
Application: Global

Key questions about this property

The answers below summarize the purpose, scope, default effect, and review scenarios for this property.

What does it do?	This property allows specified processors to bypass CSRF enforcement when the broader CSRF checks for authenticated requests are enabled, preventing HTTP 401 rejections for those processors.
What area does it affect?	CSRF Security Enforcement
What does the default mean?	No default value is documented in this property record.
When should you review it?	Review this property when configuring CSRF protection for authenticated processors or when adding new processors.

Out of the box property record

Raw metadata from the property record.

Property name	`glide.security.csrf.httpauth_processor_allowlist`
Sys ID	`ccf661d3ff000310b612ffffffffff82`
Type	string
Application	Global
Default value	Not set
Description	Comma-separated list of Processors exempt from CSRF enforcement. Processors should use the require_csrf flag instead. Example: JSONv2Processor,ImportProcessor
Updated	2026-03-24 00:00:00

Sources

Official references and nearby text excerpts where this property appears.

Brazil docs View supporting context

Context preview Snippet 1

... request is rejected with an HTTP 401 response. Rejection details are logged. This enforcement applies to POST, PUT, and DELETE requests. GET requests are allowed without a CSRF token. The glide.security.csrf.httpauth_processor_allowlist property controls an exception list that allows specific processors extending HTTPAuthProcessor to bypass CSRF enforcement. When glide.security.csrf.processor.all.authenticated.enabled is active, requests to processors named in this allow-list bypass the HTTP 401 ...

More in `glide.security`

Other properties in the same namespace.

glide.security.admin.override.accessterm This property, when set to true, ensures that the admin overridable condition is assessed specifically at the glide.security.allow_unauth_roleless_acl This property controls access for unauthenticated users to resources governed by roleless scripted Access Cont glide.security.attachment_type.use_blacklist This property enables or disables the validation of file attachments against defined exclusion lists to enhanc glide.security.csrf.handle.ajax.timeout This property determines whether the system provides error handling for timed-out Ajax requests, enhancing use glide.security.csrf.processor.all.authenticated.enabled This property enforces CSRF token validation for authenticated requests, rejecting those without valid tokens glide.security.csrf.processor.all.authenticated.logging_enabled It activates logging for Cross-Site Request Forgery violations in authenticated sessions, helping to track pot glide.security.csrf.rest.public_csrf.enabled This property enforces CSRF token validation for public REST API requests, requiring a valid token to prevent glide.security.csrf.strict.validation.mode This property determines whether strict validation of CSRF tokens is enforced, blocking requests with mismatch

All 62 properties in glide.security →