Require authentication by default for client-callable script includes
By default, client-callable script includes that do not explicitly set visibility, are public. If needed, add the glide.script.ccsi.ispublic property to enable privacy control over all client-callable script includes accessed by public pages.
The glide.script.ccsi.ispublic system property makes sure that client-callable script-includes, also known as Ajax script includes, are not automatically made available to non-authenticated users. If glide.script.ccsi.ispublic is not set to the recommended value of false, then it allows script includes to be run as public scripts and allow unauthenticated users access to instance data.
Ensure that the property glide.script.ccsi.ispublic is set to false.
Warning: This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.script.ccsi.ispublic |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | |
| Recommended value | false |
| Default value | <none> |
| Fallback value | false |
| Category | Access control |
| Security risk | - Severity score: 7.5 - CVSS rating: High - Security risk details: Sensitive business logic or data is potentially exposed, increasing the risk of unauthorized access to instance resources. |
| Functional impact | If the client-callable script includes are designated as public \(that is, this property is missing\), then unauthenticated users can execute client scripts. Add the property restricts the execution of scripts by a non-logged-in user. |
| Dependencies and prerequisites | None |
Parent Topic:Access control