ServiceNow session timeout properties: glide.ui.session_timeout vs glide.ui.active.session.life_span

Inactivity timeout vs maximum lifespan

glide.ui.session_timeout is the inactivity timeout for logged in users, in minutes. The clock restarts with every request the browser sends. The documentation lists 30 minutes as the default. Values above 1440 are treated as one day, and glide.ui.max_session_timeout caps the effective value.

glide.ui.active.session.life_span is the maximum lifespan, in minutes, regardless of activity. The default 0 means no limit. With a value of 600, a user is logged out 10 hours after login even while working. ServiceNow says the lifespan should be larger than the inactivity timeout.

Example: with glide.ui.session_timeout = 60 and glide.ui.active.session.life_span = 660, a user who walks away is logged out after 60 idle minutes, and a user who works all day has to log in again after 11 hours.

glide.ui.session_timeleft and glide.ui.active.session_timeleft set how many minutes before the end users see the warning, with the option to extend. 0 turns the warning off.

1. Pick the idle timeout your security policy asks for and set glide.ui.session_timeout.
2. If the policy also asks for a daily re-login, set glide.ui.active.session.life_span to a value larger than the idle timeout, for example 600 to 720 minutes.
3. Keep the warning (glide.ui.session_timeleft) at 2 minutes or more so users can save their work.
4. Leave glide.ui.auto_req.extend.session on false so auto refreshing homepages do not keep sessions alive forever.

Guest, integration and other session types

Guests (not logged in users of a portal or chat) and integrations have their own pair of properties. Changing glide.ui.session_timeout does not change them.

Integration sessions time out after only a short idle period by default (glide.integration.session_timeout, 1 minute in the property reference). glide.integrations.active.session.life_span adds a maximum lifespan for them, which should again be larger than the idle timeout.

When a lifespan is set, glide.active.session.timeout.invalidate.session = true makes the platform end the session right away instead of leaving a short gap until the application server removes it. Security hardening recommends it. glide.active.session.timeout.exception.roles lists technical roles that are exempt from the lifespan.

1. Set glide.guest.active.session.life_span if your portal or chat serves anonymous users, so their sessions cannot stay open indefinitely.
2. Set glide.integrations.active.session.life_span larger than the longest integration run you have.
3. Set glide.active.session.timeout.invalidate.session to true once a lifespan is in place.
4. Test an integration by sending requests with the integration user over a period longer than the lifespan, and check that it re-authenticates cleanly.

Why users are not logged out, and how to test

The most common surprise: the timeout is set to a few minutes, but users are never logged out. Usually the session did end, and the Remember me cookie logged the user in again without a prompt. The cookie stays valid for remember_me_cookie.duration_in_days (15 days by default, capped by remember_me.max_duration_in_days).

Other reasons are a second open tab of the same instance, which keeps the shared session active, and SSO: after the session ends, the identity provider signs the user in again as long as its own session is still valid.

For a hard re-login, combine a lifespan with a shorter Remember me period, and clear the default of glide.ui.remember.me.default so the box is not ticked on the login page.

1. On sub-production, set glide.ui.session_timeout to 5 and glide.ui.session_timeleft to 2.
2. Open a private browser window, log in with a local test user and leave Remember me unticked. Close all other tabs of the instance.
3. Wait without clicking. The warning should appear after about 3 minutes and the session should end after 5.
4. Repeat with Remember me ticked to see the silent re-login, then set the properties back.

Check your instance

Paste this read-only background script into System Definition > Scripts - Background on a sub-production instance. It prints the current value of every property in this guide. A property without a record runs on its platform default. You can also open sys_properties.list and filter by name.

// Read only: prints the current value of every property in this guide.
// Run in System Definition > Scripts - Background.
var names = [
  'glide.ui.session_timeout',
  'glide.ui.active.session.life_span',
  'glide.ui.session_timeleft',
  'glide.ui.active.session_timeleft',
  'glide.ui.max_session_timeout',
  'glide.ui.auto_req.extend.session',
  'glide.guest.session_timeout',
  'glide.guest.active.session.life_span',
  'glide.unauthorized.session_timeout',
  'glide.integration.session_timeout',
  'glide.integrations.active.session.life_span',
  'glide.active.session.timeout.invalidate.session',
  'glide.active.session.timeout.exception.roles',
  'glide.sso.acr.ui.session.timeout',
  'remember_me_cookie.duration_in_days',
  'remember_me.max_duration_in_days',
  'glide.authenticate.max.concurrent.interactive.sessions',
  'glide.zta.high_assurance.session.timeout'
];
var found = {};
var gr = new GlideRecord('sys_properties');
gr.addQuery('name', 'IN', names.join(','));
gr.query();
while (gr.next()) {
  found[gr.getValue('name')] = gr.getValue('value');
}
for (var i = 0; i < names.length; i++) {
  var n = names[i];
  gs.print(n + ' = ' + (found.hasOwnProperty(n) ? found[n] : '(no record on this instance, platform default applies)'));
}

FAQ

Related