--- title: Configuration description: The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/platform-security/instance-security-hardening-settings/sc-configuration.html release: australia product: Instance Security Hardening Settings classification: instance-security-hardening-settings topic_type: reference last_updated: "2026-03-12" reading_time_minutes: 2 breadcrumb: [Hardening settings, Platform Security] --- # Configuration The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities. - **[Allow CORS Origins for OAuth Endpoints](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-allow-cors-origins-for-oauth-endpoints.md)** Use a system property to configure to specify which domains are allowed to make cross-origin requests. - **[Auto set content type options \[Removed in Security Center 1.3.3\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-auto-set-content-type-options.md)** Configure the Auto set content type options property on your instance to prevent MIME confusion attacks. - **[Cache-Control HTTP Header Value \[Updated in Security Center 1.3 and removed in 1.5\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-cache-control-http-header-value.md)** Use the **glide.http.cache\_control** property to set the default cache-control value in the HTTP response headers that the ServiceNow AI Platform sends when requesting static content data for a page. Examples of static content include images, CSS, and JavaScript rendered from within, for a page. - **[Enable HTTP response headers configuration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enable-http-response-headers-configuration.md)** Reduce the risk of cookie/session-related hijacking of web apps using a system property. - **[https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-chat-server-debugging.md](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-chat-server-debugging.md)** - **[Disable legacy JQuery UI usage](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-legacy-jquery-ui-usage.md)** Avoid the introduction of unpatched vulnerabilities in the library by disabling legacy JQuery UI usage. - **[Disable locked form elements debugging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-locked-form-elements-debugging.md)** Use a system property to prevent the display of explanation of locked form elements. - **[Disable MultiSSO Debugging](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-multisso-debugging.md)** The **glide.authenticate.multisso.debug** property controls debug logging for Multi-SSO. - **[Disallow target cloning \[New in Security Center 1.3\]](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disallow-target-cloning.md)** Configure the **glide.db.clone.allow\_clone\_target** property to prevent your instance from being used as a clone target. - **[Disable soap fault stack trace display](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-disable-soap-fault-stack-trace-display.md)** Manage how stack traces are displayed in your instance. - **[Restrict performance monitoring access](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-performance-monitoring-acl.md)** Use the **glide.security.diag\_txns\_acl** property to control stats.do, threads.do, thread\_pool\_stats, and replication.do access from an unauthenticated connection. - **[Enforce secure referrer policy](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-enforce-secure-referrer-policy.md)** Use the **com.glide.security.referrerpolicy** property to ensure that the Referrer-Policy HTTP header sends the appropriate level of data to each ServiceNow® page to help prevent data leaks. - **[Ensure minimum private key size](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-ensure-minimum-private-key-size.md)** Use a system property to determine the minimum size of the private key used for Certificate Signing Request \(CSR\) generation with the Certificate Inventory Management application. - **[Implement the x-frame-options: SAMEORIGIN security header](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-x-frame-options-sameorigin.md)** Use the **glide.set\_x\_frame\_options** property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages. - **[Require write access to access service catalog add item page](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-require-write-access-to-access-service-catalog-add-item-page.md)** Use the **glide.sc.request.add\_item\_write\_access** property to prevent unauthorized operations from being performed on catalog items. - **[Set Xframe options to prevent embedding third-party websites](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/sc-xframe-options.md)** Configure this property to prevent the content of a web-application from being embedded in a third-party site. **Parent Topic:**[Hardening settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/security-hardening-settings.md)