V-286765

Discussion

MIME types define how a given type of file is intended to be processed by the browser. Modern browsers are capable of determining the content type of a file by byte headers and content inspection, allowing the server dictated type to be overridden. An example would be a ".js" that was sent with a "jpg" mime type versus a JavaScript mime type. The browser would normally correct this and process the file as JavaScript. The danger is that a given file could be disguised as something else on the server, like JavaScript, opening up the door to cross-site scripting. To disable browser sniffing of content type, the connection server sends the "x-content-type-options: nosniff" header by default. This configuration must be validated and maintained over time.

Check Content

If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.

1. On the Horizon Connection Server, navigate to:

<install_directory>\sslgateway\conf

Note: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.

2. Verify the file "locked.properties" exists.

If the "locked.properties" file does not exist, this is a finding.

3. Open "locked.properties" in a text editor. If there is no "x-content-type-options" setting, this is not a finding.

If "x-content-type-options" is present and set to "OFF", this is a finding.