Skip to content
Validation › sanitization › and encoding › Hardening settings › Platform Security
Release: Australia · Updated: 2026-03-12 · Official documentation · View source

Prevent Reuse of REST API Sessions in UI/Web

Prevent REST API session cookies from bypassing Single Sign-On (SSO) and Multi-Factor Authentication (MFA) controls using a system property.

Use the com.glide.processors.aprocessor.donot_reuse_api_session to help prevent the cookies associated with the session created through the REST API from being reused to initiate UI/web sessions.

Verify that com.glide.processors.aprocessor.donot_reuse_api_session exists in the System Properties [sys_properties] table and is set to true.

More information

AttributeDescription
Configuration namecom.glide.processors.aprocessor.donot_reuse_api_session
Configuration typeSystem Properties \(/sys\_properties\_list.do\)
Data typeBoolean
Recommended valuetrue
Default valuetrue
Fallback valuefalse
CategorySession management
Security risk- Severity score: 4.3 - CVSS score: Medium - Security risk details: Reusing REST API session cookies for a web session bypasses Single Sign-On \(SSO\) and Multi-Factor Authentication \(MFA\) controls. This bypass can be an escalation of intended privileges. SSO and MFA controls are important requirements to help prevent unauthorized access to data.
Functional impact

When com.glide.processors.aprocessor.donot_reuse_api_session is set to true:

  • API session cookies can no longer be reused to initiate web sessions.
  • All web sessions require full authentication (SSO/MFA), regardless of any existing API session.

Potential Breakage:

  • Custom integrations, scripts, or legacy workflows that relied on the ability to transition from an API session to a web session without re-authentication will fail.
  • Automated processes or tools that previously bypassed SSO/MFA using API session cookies are forced to complete the full authentication flow.
  • Users may experience unexpected authentication prompts if their workflows were implicitly relying on this behavior.

Before enabling, customers should review integrations and customizations:

  • Audit all integrations, scripts, and tools that interact with the instance via API and web interfaces.
  • Identify any that may be relying on session cookie reuse for seamless transitions between API and web sessions.
Dependencies and prerequisitesNone

Parent Topic:Validation, sanitization, and encoding