---
task: Check web access for CI View (read-only)
version: R1.05 (first written for R1.03)
source: IM 36K10R10-01EN §2.2, §3.4, §4.3 (5th Edition, Feb. 2026); installed jwuiisg.sup (R1.05); practiced on the test system 2026-09-30
status: verified (read-only) on R1.03 (2026-09-30) and on the R1.05 test server (2026-10-08); access from another PC through the R1.05 Access Control settings not tested
---

# Check web access for CI View

Confirms that CI View PCs can reach this CI Portal (or CI Core + CI Portal) node. Nothing is
changed. CI Server must be running.

## 1. Configured ports

```powershell
$f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\jwuiisg.sup'
Select-String -Path $f -Pattern '^(SECURE_PORT_NUMBER|NON_SECURE_PORT_NUMBER)\b'
```

Defaults: HTTPS 8443, HTTP 8080.

## 2. Ports are listening

```powershell
(Get-NetTCPConnection -State Listen -LocalPort 8080,8443).LocalPort
```

Both ports should be listed. Nothing listed: CI Server (USER Service) is not running, or the
ports were changed.

## 3. Remote Connect page

```powershell
(Invoke-WebRequest -UseBasicParsing http://localhost:8080/).StatusCode
```

Expect `200`. This is the page CI View users open as `http://<node>:8080/` to download
Remote Connect; Remote Connect then uses HTTPS on 8443. From another PC the firewall must
allow both ports (skill `installation-security`). With `HTTP_TO_HTTPS_REDIRECT = YES`
`Invoke-WebRequest` follows the redirect to HTTPS and may fail on the server certificate;
read the HTTP status alone with `curl.exe -s -o NUL -w "%{http_code}" http://localhost:8080/`
(not tested with YES). If the site has narrowed `HOSTNAME_WHITELISTING`, a CI View must use
one of the listed names (opening the page by IP address may then fail; not tested).

On R1.05 the page also returns the default security headers from the *Security* tab of
`jwuiisg.sup` (R10 summary §4.3, ISS-111). To see them (`curl.exe` is part of Windows):

```powershell
curl.exe -k -s -I https://localhost:8443/
```

Expect `X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security`,
`X-XSS-Protection`, `Cache-Control: no-store`, `Referrer-Policy`,
`X-Permitted-Cross-Domain-Policies` and a `Content-Security-Policy` line. The R1.03 file
set only `X-Frame-Options` and no CSP.

## 4. Displays deployed

The operator interface serves displays from
`%TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\` (`components`, `displays`, `layouts`,
`locales`, `symbols`, `thresholds`). On a separate CI Portal these must be copied from CI
Core or another portal, and every portal needs the same copy.

```powershell
Get-ChildItem -Name (Join-Path $env:TLS_WAP_PATH 'cfg\operatorInterfaces\DEPLOY')
```

## Test system (2026-09-30)

8080 and 8443 listening (one process), page returned 200, the six `DEPLOY` folders present.

## R1.05 test server (2026-10-08, read-only)

Steps 1–4 as above: 8080 and 8443 listening (one `javaw.exe` running as the CI Server
service account), `http://localhost:8080/` and `https://localhost:8443/` both 200, the page
offers `CI-rc-setup.exe` (Remote Connect), the six `DEPLOY` folders present, and the seven
headers plus CSP listed above on both ports. Install paths differ from R1.03 (here
`C:\Yokogawa\CIServer`), so always use the `TLS_*` variables.

## R1.05: the CSP blocks external pages in displays (verified 2026-10-09, ISS-111)

Tested with a temporary display holding two web browser components on the R1.05 test server
(removed afterwards). The web client received `Content-Security-Policy: script-src 'self'
'unsafe-eval' 'unsafe-inline'; img-src 'self' data:; default-src 'unsafe-inline' 'self';
font-src 'self' data:` and `X-Frame-Options: sameorigin`. With no `frame-src` rule,
`default-src` applies: the browser refused to frame `https://example.com/` (a
`securitypolicyviolation` event for `frame-src`), while a page from the CI Server itself
loaded. So on R1.05 a display with an external web page (a dashboard, a camera, a vendor page)
stays empty in the browser.

**Fix (verified 2026-10-09 on the R1.05 test server):** allow the external host for frames in
`jwuiisg.sup`, *Security* tab, one `CSP_ENTRY` line per value after the installed ones:

```
CSP_ENTRY = frame-src, "'self'"
CSP_ENTRY = frame-src, "https://<allowed host>"
```

Keep `'self'`, otherwise pages from the CI Server itself are blocked in frames too. The web
server `JWUIISG` (started by `user_start.cmd`) reads the file only at start: the change takes
effect after a CI Server restart (needs administrator rights and disconnects all operator
clients). Then the header contains `frame-src 'self' https://<allowed host>`, and the test page
showed inside the display with no CSP violation. List only the hosts you need; to undo, remove
the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by
these headers (not tested).

**Who loads the framed page.** In the web client the page in a web browser component is fetched
by the viewer's own browser, not by the CI Server. So besides the `frame-src` entry, the target
site must accept requests from every machine that opens the web client: a site that only admits
the CI Server's address (IP allowlist) answers 403 to the viewers and the frame stays blank or
shows an error, although the same display works in the Operator Interface on the CI Server
(there the browser runs on the server). Check from a viewer PC with `curl -I <url>`. The target
must also not forbid framing (`X-Frame-Options` or its own CSP `frame-ancestors`). Seen on the
R1.05 test server 2026-10-09: 200 from the server, 403 from another PC.