Skip to content
IT Canvass
Development · Lesson

GlideAjax and script includes

Quick answer

Fetch server data from the browser correctly: AbstractAjaxProcessor, parameters, responses and security.

Key takeaways

  • Extend AbstractAjaxProcessor and set type to the class name
  • Use getXMLAnswer with a callback, not the synchronous variants
  • Validate parameters and roles inside the method
  • Return small payloads, JSON strings for anything structured

The server half

Create a script include that extends AbstractAjaxProcessor and tick Client callable. Every method that the browser may call must be listed in the object, and the type property must match the class name.

var IncidentAjax = Class.create();
IncidentAjax.prototype = Object.extendsObject(AbstractAjaxProcessor, {
  getOpenCount: function() {
    var ga = new GlideAggregate('incident');
    ga.addQuery('assignment_group', this.getParameter('sysparm_group'));
    ga.addQuery('active', true);
    ga.addAggregate('COUNT');
    ga.query();
    return ga.next() ? ga.getAggregate('COUNT') : '0';
  },
  type: 'IncidentAjax'
});

The client half

Always use the callback form. Synchronous calls freeze the browser and are the top cause of slow forms.

var ga = new GlideAjax('IncidentAjax');
ga.addParam('sysparm_name', 'getOpenCount');
ga.addParam('sysparm_group', g_form.getValue('assignment_group'));
ga.getXMLAnswer(function(answer) {
  g_form.addInfoMessage('Open in this group: ' + answer);
});

Security

Client callable means anyone who can open a form can call the method with any parameters. Validate inside the method, check roles with gs.hasRole, and never return data the caller could not read through the UI.

Want to learn this properly?

Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.

Check your understanding

  1. Which parameter names the method to run?

    • A. sysparm_method
    • B. sysparm_name
    • C. sysparm_function
    • D. sysparm_call
    Show answer

    B. sysparm_name

    sysparm_name maps to the method on the script include.

  2. Which call pattern should you prefer?

    • A. getXML with callback
    • B. getXMLWait
    • C. Synchronous GlideRecord
    • D. eval on the client
    Show answer

    A. getXML with callback

    Asynchronous callbacks keep the browser responsive.

Frequently asked questions

Why does my GlideAjax return nothing?

Nine times out of ten the method is not on a client callable include, sysparm_name does not match a method, or the method returned undefined instead of a string.

Is a client callable script include a security risk?

It is an API endpoint. Treat it like one: check roles, validate input, and return only what the user is allowed to see.
CallWhatsAppEnquire