V-286758

Discussion

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object> element. Sites can use this to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites. The X-Frame-Options setting is also known as counter clickjacking and is enabled by default on the Horizon Connection Server. For troubleshooting purposes, it can be disabled by adding the entry "X-Frame-Options=OFF" to the "locked.properties" file, but this must be avoided when not troubleshooting. The default configuration of enabled must be verified and maintained. Note: For supporting browsers, the X-Frame-Options setting is superseded by the Content-Security-Policy "frame-ancestors" setting.

Check Content

If the "HTTP(S) Secure Tunnel" option is not enabled in the Horizon Connection Server configuration, this requirement is not applicable.

1. On the Horizon Connection Server, navigate to:

<install_directory>\sslgateway\conf

Note: "<install_directory>" defaults to "%PROGRAMFILES%\Omnissa\Horizon\Server" unless changed during installation.

2. Verify the file "locked.properties" exists.

If the "locked.properties" file does not exist, this is a finding.

3. Open "locked.properties" in a text editor.

If there is no "X-Frame-Options" setting, this is not a finding.

If "X-Frame-Options" is present and set to "OFF", this is a finding.