Skip to content
Configuration › Hardening settings › Platform Security
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Cache-Control HTTP Header Value [Updated in Security Center 1.3 and removed in 1.5]

Use the glide.http.cache_control property to set the default cache-control value in the HTTP response headers that the ServiceNow AI Platform sends when requesting static content data for a page. Examples of static content include images, CSS, and JavaScript rendered from within, for a page.

The glide.http.cache_control property sets the default Cache-Control value in HTTP response headers to private or public. The default is private.

ValueDescription
privateStatic content can be cached at the browser (client) level, but not at the proxy server level.
publicStatic content can be cached at the browser (client) level, and also at the proxy server level.

The Expires value in the HTTP response headers control when the static content expires, and has a default value of 369 days. To manually override the default value, use the glide.http.expire.days property.

Image omitted: Cache-Control-header.png
Control-Cache and Expires HTTP response header values

Note: You can use the glide.http.cache property designate whether to enable or disable setting of the Cache-Control and Expires values in HTTP response headers. Its default is true, which allows you to set the:

  • Cache-Control value default using the glide.http.cache_control property.
  • Expires value default using the glide.http.expire.days property.

More information

AttributeDescription
Property nameglide.http.cache_control
Configuration typeSystem Properties \(/sys\_properties\_list.do\)
CategoryConfiguration
PurposeTo configure the Cache-Control HTTP response header value for static content.
Recommended valueprivate
Default valueprivate
Security risk rating4.3
Functional impactSets the default Cache-Control value in an HTTP response header.
Security risk(High) If you set this property to public, instances with CDN/proxies may cache static content and render without authentication. - private is a more appropriate setting for instances with CDN/proxy setup. - If an the instance does not have a CDN/proxy setup, either value should be fine.

To learn more about adding or creating a system property, see Add a system property.

Parent Topic:Configuration