---
task: Check web access for CI View (read-only)
version: R1.05 (first written for R1.03)
source: IM 36K10R10-01EN §2.2, §3.4, §4.3 (5th Edition, Feb. 2026); installed jwuiisg.sup (R1.05); practiced on the test system 2026-09-30
status: verified (read-only) on R1.03 (2026-09-30) and on the R1.05 test server (2026-10-08); access from another PC through the R1.05 Access Control settings not tested
---

# Check web access for CI View

Confirms that CI View PCs can reach this CI Portal (or CI Core + CI Portal) node. Nothing is
changed. CI Server must be running.

## 1. Configured ports

```powershell
$f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\jwuiisg.sup'
Select-String -Path $f -Pattern '^(SECURE_PORT_NUMBER|NON_SECURE_PORT_NUMBER)\b'
```

Defaults: HTTPS 8443, HTTP 8080.

## 2. Ports are listening

```powershell
(Get-NetTCPConnection -State Listen -LocalPort 8080,8443).LocalPort
```

Both ports should be listed. Nothing listed: CI Server (USER Service) is not running, or the
ports were changed.

## 3. Remote Connect page

```powershell
(Invoke-WebRequest -UseBasicParsing http://localhost:8080/).StatusCode
```

Expect `200`. This is the page CI View users open as `http://<node>:8080/` to download
Remote Connect; Remote Connect then uses HTTPS on 8443. From another PC the firewall must
allow both ports (skill `installation-security`). With `HTTP_TO_HTTPS_REDIRECT = YES`
`Invoke-WebRequest` follows the redirect to HTTPS and may fail on the server certificate;
read the HTTP status alone with `curl.exe -s -o NUL -w "%{http_code}" http://localhost:8080/`
(not tested with YES). If the site has narrowed `HOSTNAME_WHITELISTING`, a CI View must use
one of the listed names (opening the page by IP address may then fail; not tested).

On R1.05 the page also returns the default security headers from the *Security* tab of
`jwuiisg.sup` (R10 summary §4.3, ISS-111). To see them (`curl.exe` is part of Windows):

```powershell
curl.exe -k -s -I https://localhost:8443/
```

Expect `X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security`,
`X-XSS-Protection`, `Cache-Control: no-store`, `Referrer-Policy`,
`X-Permitted-Cross-Domain-Policies` and a `Content-Security-Policy` line. The R1.03 file
set only `X-Frame-Options` and no CSP.

## 4. Displays deployed

The operator interface serves displays from
`%TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\` (`components`, `displays`, `layouts`,
`locales`, `symbols`, `thresholds`). On a separate CI Portal these must be copied from CI
Core or another portal, and every portal needs the same copy.

```powershell
Get-ChildItem -Name (Join-Path $env:TLS_WAP_PATH 'cfg\operatorInterfaces\DEPLOY')
```

## Test system (2026-09-30)

8080 and 8443 listening (one process), page returned 200, the six `DEPLOY` folders present.

## R1.05 test server (2026-10-08, read-only)

Steps 1–4 as above: 8080 and 8443 listening (one `javaw.exe` running as the CI Server
service account), `http://localhost:8080/` and `https://localhost:8443/` both 200, the page
offers `CI-rc-setup.exe` (Remote Connect), the six `DEPLOY` folders present, and the seven
headers plus CSP listed above on both ports. Install paths differ from R1.03 (here
`C:\Yokogawa\CIServer`), so always use the `TLS_*` variables.

## R1.05: the CSP blocks external pages in displays (verified 2026-10-09, ISS-111)

Tested with a temporary display holding two web browser components on the R1.05 test server
(removed afterwards). The web client received `Content-Security-Policy: script-src 'self'
'unsafe-eval' 'unsafe-inline'; img-src 'self' data:; default-src 'unsafe-inline' 'self';
font-src 'self' data:` and `X-Frame-Options: sameorigin`. With no `frame-src` rule,
`default-src` applies: the browser refused to frame `https://example.com/` (a
`securitypolicyviolation` event for `frame-src`), while a page from the CI Server itself
loaded. So on R1.05 a display with an external web page (a dashboard, a camera, a vendor page)
stays empty in the browser.

**Fix (verified 2026-10-09 on the R1.05 test server):** allow the external host for frames in
`jwuiisg.sup`, *Security* tab, one `CSP_ENTRY` line per value after the installed ones:

```
CSP_ENTRY = frame-src, "'self'"
CSP_ENTRY = frame-src, "https://<allowed host>"
```

Keep `'self'`, otherwise pages from the CI Server itself are blocked in frames too. The web
server `JWUIISG` (started by `user_start.cmd`) reads the file only at start: the change takes
effect after a CI Server restart (needs administrator rights and disconnects all operator
clients). Then the header contains `frame-src 'self' https://<allowed host>`, and the test page
showed inside the display with no CSP violation. List only the hosts you need; to undo, remove
the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by
these headers (not tested).