How to verify the HTTP Security Headers in NSX Manager

Products

• VMware NSX

Issue/Introduction

This document describes how to validate the HTTP security headers used by NSX Manager.

Environment

VMware NSX

Resolution

Run the curl command below from any operating system that has curl installed and can reach the NSX Manager:

curl -I -k https://<FQDN-of-NSX-Manager>

This command displays the HTTP response from NSX Manager, including the HTTP security headers in use.

Below is an example output showing that the Content Security Policy (CSP) HTTP security headers are applied:

[ ~ ]# curl -I -k https://<FQDN-of-NSX-Manager>
HTTP/1.1 302 Found
set-cookie: JSESSIONID=##############################75; Path=/; Secure; HttpOnly; SameSite=Lax
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
x-xss-protection: 1; mode=block
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
date: Mon, 10 Aug 2026 00:23:09 GMT
location: https://<FQDN-of-NSX-Manager>/login.jsp
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: frame-src 'self' blob:; frame-ancestors 'self'
vary: Accept-Encoding
server: envoy
transfer-encoding: chunked

 

Referrer Policy Header:

By default, most modern browsers automatically apply the strict-origin-when-cross-origin policy when an application does not explicitly specify a Referrer-Policy header.

You can verify this in Chrome by opening Developer Tools (Ctrl + Shift + I), navigating to the Network tab, selecting the login.jsp request, and reviewing the Headers section.

The example screenshot below demonstrates that the HTTP security header Referrer-Policy: strict-origin-when-cross-origin is applied to NSX Manager.