---
title: Enhanced Security Properties
slug: v111/enhanced-security-properties
icon: {"faIcon":"fa-solid fa-unlock-keyhole"}
docTags:
createdAt: 2025-06-10T06:44:31.748Z
---
This page outlines options and recommendations on settings that can be used within the Servicely application to customise the security configuration to meet individual company requirements.
## Application Properties
| **Property Key** | **Description** | **Default value** |
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------ |
| system.auth.remember.me.enabled | Allows the ‘Remember me’ functionality to be enabled/disabled.
When enabled (default), the ‘Remember me’ function allows the user to stay logged in past the session timeout limit. This is achieved by storing an encrypted token in a cookie that allows the user to authenticate to the system without providing login credentials.
Does not apply to users using Single Sign-On or for API access. | true |
| system.auth.remember.me.expiry | Sets the expiry period for the ‘Remember me’ function if enabled. Value is number of seconds. | 2592000 |
| system.auth.remember.me.challenge.token | Adds a challenge token to the encrypted ‘Remember Me' token. Provides a simple mechanism to invalidate all currently issued 'Remember me’ tokens. | null |
| system.security.concurrent\_sessions\_enabled | Specifies whether users are permitted to login into multiple concurrent sessions.
If set to false, users will be logged out of other sessions if they successfully log in to another session. | true |
| system.auth.basic.enable | Enables or disables Basic Authentication for API access. | true |
| system.auth.bearer.enable | Enables or disables Bearer Authentication for API access. | true |
| system.auth.bearer.token.url.enable | Enables or disables Bearer Authentication via URL for API access.
To use this functionality, you need to be on Version 1.10 or later. | false |
| system.auth.ldap.enable | Enables or disables LDAP Authentication for Application access. | false |
| system.auth.login.multiple\_provider\_form | Enables or disables the ‘Multiple Provider’ functionality of the login form.
When true, the user will be required to enter their username first, and then the users configured login mechanism (Password/LDAP/SAML) will be invoked. | false |
| system.http.session.timeout | Sets the HTTP Session Timeout for the users session.
Value is in Minutes. | 600
(10 hours) |
| system.password.reset.expiry.hours | The amount of hours a password reset request is value.
Value is in hours. | 24 |
| system.password.reset.locations
(Client side) | The locations where the password reset option shows up. Note that it has to be enabled to show up at all.
Values can include:
- menu
- menu,login
- login | menu,login |
| system.password.reset.enabled
(Client side) | Determines whether or not the password reset option appears or not
Value is boolean | true |
| system.upload.limit | Largest file that can be uploaded as an attachment | 10MB |
| system.upload.accept | Mime types and suffixes that will be accepted by Servicely. If blank then every mime type will be accepted | You can find this in your Servicely instance’s application property, otherwise please contact us if you need this information. |
| system.upload.reject | Mime types and suffixes that will be rejected by Servicely. If blank then no mime type will be rejected | You can find this in your Servicely instance’s application property, otherwise please contact us if you need this information. |
| system.upload.spoofing.check | If true then the mime type sent by the browser will be compared with the server-determined mime type and the file will be rejected if they are different | true |
| system.upload.spoofing.equivalent.types | Lists of mime types that are considered equivalent when a spoofing check is made. Equivalent types do not cause a rejection | \[\[ "application/zip", "application/x-zip-compressed" ],\[ "application/xml", "text/xml", "text/html" ]] |
| system.http.client.disable.ssl.validation.allowed | Allows you to disable SSL validation for integration calls.
Value is a boolean
To use this functionality, you need to be on Version 1.10 or later. | false |
| system.upload.role\_required | This allows you to define a specific role that is required to allow you to upload attachments through journal, html and attachment fields.
Value is a role name
To use this functionality, you need to be on Version 1.10 or later. | administrator |
| system.upload.permitted | Allows uploading through areas other than through the UI (such as emails).
Value is a boolean
To use this functionality, you need to be on Version 1.10 or later. | true |