cliu 03bf567972 R1.05 HMI tests with temporary displays: web trend, web browser CSP

With the user's approval two temporary displays were deployed, viewed in
the web client and removed (display folders identical before/after):
- a 2-pen trend draws on the R1.05 web client (ISS-096 closed; ISS-041
  fixed on R1.05);
- the default R1.05 Content-Security-Policy blocks external pages in a
  web browser component; same-origin pages load (ISS-111).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-09 11:42:04 +11:00

4.2 KiB

Raw Blame History

task	version	source	status
Check web access for CI View (read-only)	R1.05 (first written for R1.03)	IM 36K10R10-01EN §2.2, §3.4, §4.3 (5th Edition, Feb. 2026); installed jwuiisg.sup (R1.05); practiced on the test system 2026-09-30	verified (read-only) on R1.03 (2026-09-30) and on the R1.05 test server (2026-10-08); access from another PC through the R1.05 Access Control settings not tested

Check web access for CI View

Confirms that CI View PCs can reach this CI Portal (or CI Core + CI Portal) node. Nothing is changed. CI Server must be running.

1. Configured ports

$f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\jwuiisg.sup'
Select-String -Path $f -Pattern '^(SECURE_PORT_NUMBER|NON_SECURE_PORT_NUMBER)\b'

Defaults: HTTPS 8443, HTTP 8080.

2. Ports are listening

(Get-NetTCPConnection -State Listen -LocalPort 8080,8443).LocalPort

Both ports should be listed. Nothing listed: CI Server (USER Service) is not running, or the ports were changed.

3. Remote Connect page

(Invoke-WebRequest -UseBasicParsing http://localhost:8080/).StatusCode

Expect 200. This is the page CI View users open as http://<node>:8080/ to download Remote Connect; Remote Connect then uses HTTPS on 8443. From another PC the firewall must allow both ports (skill installation-security). With HTTP_TO_HTTPS_REDIRECT = YES Invoke-WebRequest follows the redirect to HTTPS and may fail on the server certificate; read the HTTP status alone with curl.exe -s -o NUL -w "%{http_code}" http://localhost:8080/ (not tested with YES). If the site has narrowed HOSTNAME_WHITELISTING, a CI View must use one of the listed names (opening the page by IP address may then fail; not tested).

On R1.05 the page also returns the default security headers from the Security tab of jwuiisg.sup (R10 summary §4.3, ISS-111). To see them (curl.exe is part of Windows):

curl.exe -k -s -I https://localhost:8443/

Expect X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, X-XSS-Protection, Cache-Control: no-store, Referrer-Policy, X-Permitted-Cross-Domain-Policies and a Content-Security-Policy line. The R1.03 file set only X-Frame-Options and no CSP.

4. Displays deployed

The operator interface serves displays from %TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\ (components, displays, layouts, locales, symbols, thresholds). On a separate CI Portal these must be copied from CI Core or another portal, and every portal needs the same copy.

Get-ChildItem -Name (Join-Path $env:TLS_WAP_PATH 'cfg\operatorInterfaces\DEPLOY')

Test system (2026-09-30)

8080 and 8443 listening (one process), page returned 200, the six DEPLOY folders present.

R1.05 test server (2026-10-08, read-only)

Steps 1–4 as above: 8080 and 8443 listening (one javaw.exe running as the CI Server service account), http://localhost:8080/ and https://localhost:8443/ both 200, the page offers CI-rc-setup.exe (Remote Connect), the six DEPLOY folders present, and the seven headers plus CSP listed above on both ports. Install paths differ from R1.03 (here C:\Yokogawa\CIServer), so always use the TLS_* variables.

R1.05: the CSP blocks external pages in displays (verified 2026-10-09, ISS-111)

Tested with a temporary display holding two web browser components on the R1.05 test server (removed afterwards). The web client received Content-Security-Policy: script-src 'self' 'unsafe-eval' 'unsafe-inline'; img-src 'self' data:; default-src 'unsafe-inline' 'self'; font-src 'self' data: and X-Frame-Options: sameorigin. With no frame-src rule, default-src applies: the browser refused to frame https://example.com/ (a securitypolicyviolation event for frame-src), while a page from the CI Server itself loaded. So on R1.05 a display with an external web page (a dashboard, a camera, a vendor page) stays empty in the browser. Possible fix, not tested: add a CSP_ENTRY with frame-src 'self' https://<allowed host> on the Security tab of jwuiisg.sup (administrator; check whether the web server needs a restart). The desktop Operator Interface (JCEF browser) is not affected by these headers (not tested).

4.2 KiB Raw Blame History Unescape Escape