Mandatory Validation of Origin HTTP Header

To strengthen the protection against attacks related to Cross-Origin Resource Sharing (CORS), the HTTP header Origin (if present in a HTTP request) is validated by default against an allowed list of permitted origins in the Horizon Settings. This list includes:

• Origins that are dynamically computed based on network configurations, Horizon Settings, and High Availability Settings. All these origins are auto allowed.
• Origins that can be explicitly configured by the administrator.

Auto Allowed List

On saving the Horizon Settings, the following are automatically added to the allowed list. The items in the auto allowed list cannot be deleted by the administrator.

• Individual network interface IP
• UAG Name mentioned in System Configuration
• High Availability Virtual IP
• Tunnel External URL and Tunnel URLs, when port is either not specified or 443 is specified
• Blast External URL and Blast URLs, if port specified is 443

Any incoming requests with following Origin header format are allowed:

• https://<hostname or IP>
• https://<hostname or IP>:443
• <hostname or IP>
• <hostname or IP>:443

Explicitly Configured List

If HTTP requests can arrive at Unified Access Gateway with values in Origin header other than the ones computed dynamically, these values must be added to the allowed list explicitly by the administrator using one of following methods:

• Using the Auto Allowed List setting in the Admin UI > Edge Service Settings > Horizon Settings.
• Using the .ini file while deploying through PowerShell script. A sample INI file is included with the deployment script to help configure this list.

Sample configuration

[Horizon]
....
originCheckEnabled=true
originHeaderDetailsList=1,2,3

[OriginHeaderDetails1]
origin=userorigin.com
rewriteEnabled=true

[OriginHeaderDetails2]
origin=tunnelurl.com
rewriteEnabled=false

[OriginHeaderDetails3]
origin=https://uag-origin.test.com:443
rewriteEnabled=true

By default, the Re-Write Origin toggle (on Admin UI) or rewriteEnabled field in .ini file is disabled for all entries in the Auto Allowed List. If this is enabled for the specified origin and a HTTP request contains this value in the HTTP header Origin, this HTTP header value is re-written to the value specified in the Connection Server URL when Unified Access Gateway is sending the request to Horizon Connection Server.

If the Origin header value in a HTTP request is not part of this allowed list, it responds with HTTP 404.

Upgrade from an Older Version to 25.03 and later

If a HTTP request to Unified Access Gateway has an Origin value that is not in the auto-allowed list after the upgrade, the administrator must manually add it. See Explicitly Configured List.