V-286759

Discussion

RFC 6454 Origin Checking, which protects against cross-site request forging, is enabled by default on the Horizon Connection Server. When an administrator opens the Horizon Console or a user connects to Blast HTML Access, the server checks that the origin URL for the web request matches either the configured secure tunnel URL or "localhost". When the connection server is load balanced or front-ended by a Unified Access Gateway (UAG) appliance, origin checking will fail. This is commonly resolved by disabling origin checking entirely by specifying "checkOrigin=false" in the "locked.properties" file. This is not the proper solution. Instead, origin checking must be enabled and the load balancer and UAG appliances must be allow listed via the "balancedHost" and "portalHost.X" settings in "locked.properties", respectively. Additionally, the "locked.properties" should contain a setting for "allowUnexpectedHost=false". This setting currently defaults to "true" and must be explicitly set to "false" to cause requests to be rejected if the Host header does not match an entry on the allow list. Origin checking can be disabled by adding the entry "checkOrigin=false" to "locked.properties", usually for troubleshooting purposes. The default, "checkOrigin=true" or unspecified configuration must be verified and maintained.

Check Content

If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.

1. On the Horizon Connection Server, navigate to:

<install_directory>\sslgateway\conf

Note: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.

2. Verify the file "locked.properties" exists.

If the "locked.properties" file does not exist, this is a finding.

3. Open "locked.properties" in a text editor. Find the "allowUnexpectedHost" setting. Verify it is set as follows: 

allowUnexpectedHost=false

If "allowUnexpectedHost" is missing or is not set to "false", this is a finding.

4. Find the "checkOrigin" setting. Verify it is set as follows:
 
checkOrigin=true

If "checkOrigin" is missing or is not set to "true", this is a finding.

5. Review the configured load balancer.

If "balancedHost=<load-balancer-name-here>" is not set to a valid load balancer, this is a finding.

6. Review the list of UAGs:

portalHost.1=<access-point-name-1>
portalHost.2=<access-point-name-2>

If the UAG addresses are not correct and in the order above, this is a finding.