Host Header Validation on Unified Access Gateway

To strengthen protection against host header attacks, Unified Access Gateway (UAG) validates the HTTP Host and X-Forwarded-Host headers in every incoming request by default. This validation is enforced against a list of permitted host headers, which includes both dynamically computed and explicitly configured hostnames and ports.

Host Header Validation Lists

Auto Allowed List

When UAG network, high availability and Edge Service settings are saved, the following entries are automatically added to the Auto-Allowed Host Headers list.

The entries in the Auto Allowed List are meant for reference only.

• Individual network interface IPs
• UAG name from System Configuration
• High Availability Virtual IP
• Horizon Settings
  • External URLs configured for Tunnel and Blast
  • Blast External URL and Additional Blast External URLs
  • Tunnel External URL and Additional Tunnel External URLs
  • Host Port Redirect Mapping entries
• Proxy host pattern and External URL in Web Reverse Proxy Settings

Any incoming requests with the following host header formats are allowed if their values match entries in the Auto Allowed List:

• <hostname or IP>
• <hostname or IP>:443
• <hostname or IP>:80
• <hostname or IP>:9443
• <hostname or IP>:<other-auto-allowed-port>

Examples of accepted Host headers

Scenario 1: If uag.myco.com is auto-allowed, the following Host headers are accepted:

• uag.myco.com
• uag.myco.com:443
• uag.myco.com:80 (not allowed when connecting to admin interface on port 9443)
• uag.myco.com:9443 (allowed only when connecting admin interface on port 9443)

Scenario 2: If test.com:10443 is auto-allowed, only test.com:10443 is accepted.

Explicitly Configured List

If HTTP requests arrive to Unified Access Gateway with Host header values other than those computed dynamically, these values must be added to the allowed list explicitly by the administrator using one of the following options:

• Option 1: Using the Allowed Host Headers setting in the Admin UI > System Configuration.

• Option 2: Using the .ini file while deploying through PowerShell script

  Sample Configuration

  [General]

  allowedHostHeaderValues=abc.com,abc.com:10443,uag1.example.com,uag-lb.example.com

• Option 3: Using the CLI command: adminreset --allowedHostHeader

Port-Specific Validation Logic

• If a plain hostname, for example, uag1.myco.com is added, Unified Access Gateway automatically allows requests having host header with the ports 443, 80, 9443, and empty port.

• If a hostname with a specific port, for example, uag1.myco.com:10443 is added, only requests with the explicitly listed host:port are allowed.

Examples for allowed header formats

Troubleshooting Host Header Validation

If the Host Header value in an incoming request is not part of the allowed list, UAG responds with HTTP 400.

Check the following log files for rejection messages:

/opt/omnissa/gateway/logs/admin.log (Admin service)

/opt/omnissa/gateway/logs/esmanager.log (Horizon/Web Reverse Proxy traffic)

Common log messages

• Rejecting request from <source>. The request was rejected because the domain <uag-hostname> is untrusted.

• UAGW00388: Sending bad request. Incoming request does not have valid host header: <host-header-value>, XFH: <xfh-header-value>

• Redirect host <redirect-host> does not match the allowed hosts. Hence sending 400