Mitigating Cross-Site Scripting Attacks

x-xss-protection header

Note: The x-xss-protection header applies only to Horizon 2312 and earlier. It was removed from the product starting with Horizon 2406.

By default, Horizon 8 employs the XSS (cross-site scripting) Filter feature to mitigate cross-site scripting attacks by sending the header x-xss-protection=1; mode=block` in its HTTP responses.

You can deactivate this feature by adding the following entry to the file locked.properties:

x-xss-protection=OFF

x-permitted-cross-domain-policies header

Note: This feature only applies to Horizon 2406 and later.

The x-permitted-cross-domain-policies header allows granular access control to Adobe Flash and Adobe Acrobat. The default value is none.

You can deactivate this feature by adding the following entry to the file locked.properties:

x-permitted-cross-domain-policies=OFF