cliu
03bf567972
With the user's approval two temporary displays were deployed, viewed in the web client and removed (display folders identical before/after): - a 2-pen trend draws on the R1.05 web client (ISS-096 closed; ISS-041 fixed on R1.05); - the default R1.05 Content-Security-Policy blocks external pages in a web browser component; same-origin pages load (ISS-111). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
92 lines
4.2 KiB
Markdown
92 lines
4.2 KiB
Markdown
---
|
||
task: Check web access for CI View (read-only)
|
||
version: R1.05 (first written for R1.03)
|
||
source: IM 36K10R10-01EN §2.2, §3.4, §4.3 (5th Edition, Feb. 2026); installed jwuiisg.sup (R1.05); practiced on the test system 2026-09-30
|
||
status: verified (read-only) on R1.03 (2026-09-30) and on the R1.05 test server (2026-10-08); access from another PC through the R1.05 Access Control settings not tested
|
||
---
|
||
|
||
# Check web access for CI View
|
||
|
||
Confirms that CI View PCs can reach this CI Portal (or CI Core + CI Portal) node. Nothing is
|
||
changed. CI Server must be running.
|
||
|
||
## 1. Configured ports
|
||
|
||
```powershell
|
||
$f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\jwuiisg.sup'
|
||
Select-String -Path $f -Pattern '^(SECURE_PORT_NUMBER|NON_SECURE_PORT_NUMBER)\b'
|
||
```
|
||
|
||
Defaults: HTTPS 8443, HTTP 8080.
|
||
|
||
## 2. Ports are listening
|
||
|
||
```powershell
|
||
(Get-NetTCPConnection -State Listen -LocalPort 8080,8443).LocalPort
|
||
```
|
||
|
||
Both ports should be listed. Nothing listed: CI Server (USER Service) is not running, or the
|
||
ports were changed.
|
||
|
||
## 3. Remote Connect page
|
||
|
||
```powershell
|
||
(Invoke-WebRequest -UseBasicParsing http://localhost:8080/).StatusCode
|
||
```
|
||
|
||
Expect `200`. This is the page CI View users open as `http://<node>:8080/` to download
|
||
Remote Connect; Remote Connect then uses HTTPS on 8443. From another PC the firewall must
|
||
allow both ports (skill `installation-security`). With `HTTP_TO_HTTPS_REDIRECT = YES`
|
||
`Invoke-WebRequest` follows the redirect to HTTPS and may fail on the server certificate;
|
||
read the HTTP status alone with `curl.exe -s -o NUL -w "%{http_code}" http://localhost:8080/`
|
||
(not tested with YES). If the site has narrowed `HOSTNAME_WHITELISTING`, a CI View must use
|
||
one of the listed names (opening the page by IP address may then fail; not tested).
|
||
|
||
On R1.05 the page also returns the default security headers from the *Security* tab of
|
||
`jwuiisg.sup` (R10 summary §4.3, ISS-111). To see them (`curl.exe` is part of Windows):
|
||
|
||
```powershell
|
||
curl.exe -k -s -I https://localhost:8443/
|
||
```
|
||
|
||
Expect `X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security`,
|
||
`X-XSS-Protection`, `Cache-Control: no-store`, `Referrer-Policy`,
|
||
`X-Permitted-Cross-Domain-Policies` and a `Content-Security-Policy` line. The R1.03 file
|
||
set only `X-Frame-Options` and no CSP.
|
||
|
||
## 4. Displays deployed
|
||
|
||
The operator interface serves displays from
|
||
`%TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\` (`components`, `displays`, `layouts`,
|
||
`locales`, `symbols`, `thresholds`). On a separate CI Portal these must be copied from CI
|
||
Core or another portal, and every portal needs the same copy.
|
||
|
||
```powershell
|
||
Get-ChildItem -Name (Join-Path $env:TLS_WAP_PATH 'cfg\operatorInterfaces\DEPLOY')
|
||
```
|
||
|
||
## Test system (2026-09-30)
|
||
|
||
8080 and 8443 listening (one process), page returned 200, the six `DEPLOY` folders present.
|
||
|
||
## R1.05 test server (2026-10-08, read-only)
|
||
|
||
Steps 1–4 as above: 8080 and 8443 listening (one `javaw.exe` running as the CI Server
|
||
service account), `http://localhost:8080/` and `https://localhost:8443/` both 200, the page
|
||
offers `CI-rc-setup.exe` (Remote Connect), the six `DEPLOY` folders present, and the seven
|
||
headers plus CSP listed above on both ports. Install paths differ from R1.03 (here
|
||
`C:\Yokogawa\CIServer`), so always use the `TLS_*` variables.
|
||
|
||
## R1.05: the CSP blocks external pages in displays (verified 2026-10-09, ISS-111)
|
||
|
||
Tested with a temporary display holding two web browser components on the R1.05 test server
|
||
(removed afterwards). The web client received `Content-Security-Policy: script-src 'self'
|
||
'unsafe-eval' 'unsafe-inline'; img-src 'self' data:; default-src 'unsafe-inline' 'self';
|
||
font-src 'self' data:` and `X-Frame-Options: sameorigin`. With no `frame-src` rule,
|
||
`default-src` applies: the browser refused to frame `https://example.com/` (a
|
||
`securitypolicyviolation` event for `frame-src`), while a page from the CI Server itself
|
||
loaded. So on R1.05 a display with an external web page (a dashboard, a camera, a vendor page)
|
||
stays empty in the browser. Possible fix, **not tested**: add a `CSP_ENTRY` with
|
||
`frame-src 'self' https://<allowed host>` on the *Security* tab of `jwuiisg.sup` (administrator;
|
||
check whether the web server needs a restart). The desktop Operator Interface (JCEF browser) is
|
||
not affected by these headers (not tested).
|