World Wide Web Consortium Standards

Connection Server complies with certain World Wide Web Consortium (W3C) standards.

These standards apply to all versions of Horizon 8:

• Cross-Origin Resource Sharing (CORS) constrains client-side cross-origin requests. You can deactivate it by adding the entry enableCORS=false to locked.properties.
• Content Security Policy (CSP), which mitigates a broad class of content injection vulnerabilities, is activated by default. You can deactivate it by adding the entry enableCSP=false to locked.properties.

These only apply to Horizon 2406 and later:

• Permissions Policy allows selectively enabling/disabling use of various browser features and APIs, and is deactivated by default. To activate, configure the headers by adding a property to locked.properties and restart the secure gateway service. In the following example, this property activates the header and simultaneously configures its content. Make sure that you set this header to only comply with your security policy as failure to do so may result in weakening your security. For example:

  permsPolicy = camera=(), microphone=(self https://example.com), screen-wake-lock=*

• Referrer Policy is set to strict-origin-when-cross-origin by default. You can deactivate it by adding the entry referrerPolicy=OFF to locked.properties, or, you can set an alternative value and then restart the secure gateway service. For example:

  referrerPolicy = strict-origin-when-cross-origin

  Note: In earlier releases, this header could not be set. In the absence of this header, most browsers will default to strict-origin-when-cross-origin.