By default, VMware Horizon accepts requests with the following declared content types only:

  • application/x-www-form-urlencoded
  • application/xml
  • text/xml
Note: In earlier releases, this protection was disabled by default.
To restrict the content types that VMware Horizon accepts, add the following entry to the file locked.properties:
acceptContentType.1=content-type
For example:
acceptContentType.1=x-www-form-urlencoded

To accept another content type, add the entry acceptContentType.2=content-type, and so on

To accept requests with any declared content type, specify acceptContentType=*.