VMware Horizon Community
chulerico
Enthusiast
Enthusiast

Horizon 7 origin URL

So Horizon 7 introduces new security feature that checks origin URL, thus impacting some load balance connections.

Tested:

VMware Windows Client - ok

Zero client tera1/tera2 - ok

Firefox Web Client - ok

Internet Explorer Web Client - ok

Google Chrome - not working, admin page - administrators (you received empty page), regular web client - users (you received error and "Failed to connect to the Connection Server.")

Apple Safari - not working, same as Google Chrome

Security feature can be turn off, for more info follow link below (must be done on all brokers, even security to be effective)

Accessing the Horizon View Administrator page displays a blank error window in Horizon 7 (2144768) |...

Summary points:

* This new "security" feature seems broken

* Very odd that in my case, only chrome/safari seems to be "working" correctly, was these the only browsers tested lol

* Like many "new" features implemented by VMware and other major software providers, they don't get it right the first time, I think these "new" features should always be optional, gives you time to fix things and you have less angry customers/support requests

I see this time and time again, just to see it being optional on the next release because of all the backlash, one being agent usb redirection for example.

I think this feature would be great, if regular web clients were ok, while affecting only admin page, does add a bit more security specially if the customer doesn't use security servers.

IT is fun.

Sam

2 Replies
massmans
Contributor
Contributor

this may work.    https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=21447...

I have noticed that Firefox is a lot more forgiving and will connect with Chrome and Safari will not. 

0 Kudos
markbenson
VMware Employee
VMware Employee

All browsers are tested.

Origin checking was added for Horizon 7 to further improve security. RFC 6454 Origin Checking protects against cross-site request forging and is now enabled by default.

Configure locked.properties as described here.

Mark