cliu
732c6fb2da
The user added CSP_ENTRY frame-src 'self' and the test host to jwuiisg.sup and restarted CI Server (JWUIISG reads the file only at start). The header then allowed the host and the external page showed in a temporary display in the web client (display removed again). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
105 lines
4.7 KiB
Markdown
105 lines
4.7 KiB
Markdown
---
|
||
task: Check web access for CI View (read-only)
|
||
version: R1.05 (first written for R1.03)
|
||
source: IM 36K10R10-01EN §2.2, §3.4, §4.3 (5th Edition, Feb. 2026); installed jwuiisg.sup (R1.05); practiced on the test system 2026-09-30
|
||
status: verified (read-only) on R1.03 (2026-09-30) and on the R1.05 test server (2026-10-08); access from another PC through the R1.05 Access Control settings not tested
|
||
---
|
||
|
||
# Check web access for CI View
|
||
|
||
Confirms that CI View PCs can reach this CI Portal (or CI Core + CI Portal) node. Nothing is
|
||
changed. CI Server must be running.
|
||
|
||
## 1. Configured ports
|
||
|
||
```powershell
|
||
$f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\jwuiisg.sup'
|
||
Select-String -Path $f -Pattern '^(SECURE_PORT_NUMBER|NON_SECURE_PORT_NUMBER)\b'
|
||
```
|
||
|
||
Defaults: HTTPS 8443, HTTP 8080.
|
||
|
||
## 2. Ports are listening
|
||
|
||
```powershell
|
||
(Get-NetTCPConnection -State Listen -LocalPort 8080,8443).LocalPort
|
||
```
|
||
|
||
Both ports should be listed. Nothing listed: CI Server (USER Service) is not running, or the
|
||
ports were changed.
|
||
|
||
## 3. Remote Connect page
|
||
|
||
```powershell
|
||
(Invoke-WebRequest -UseBasicParsing http://localhost:8080/).StatusCode
|
||
```
|
||
|
||
Expect `200`. This is the page CI View users open as `http://<node>:8080/` to download
|
||
Remote Connect; Remote Connect then uses HTTPS on 8443. From another PC the firewall must
|
||
allow both ports (skill `installation-security`). With `HTTP_TO_HTTPS_REDIRECT = YES`
|
||
`Invoke-WebRequest` follows the redirect to HTTPS and may fail on the server certificate;
|
||
read the HTTP status alone with `curl.exe -s -o NUL -w "%{http_code}" http://localhost:8080/`
|
||
(not tested with YES). If the site has narrowed `HOSTNAME_WHITELISTING`, a CI View must use
|
||
one of the listed names (opening the page by IP address may then fail; not tested).
|
||
|
||
On R1.05 the page also returns the default security headers from the *Security* tab of
|
||
`jwuiisg.sup` (R10 summary §4.3, ISS-111). To see them (`curl.exe` is part of Windows):
|
||
|
||
```powershell
|
||
curl.exe -k -s -I https://localhost:8443/
|
||
```
|
||
|
||
Expect `X-Content-Type-Options`, `X-Frame-Options`, `Strict-Transport-Security`,
|
||
`X-XSS-Protection`, `Cache-Control: no-store`, `Referrer-Policy`,
|
||
`X-Permitted-Cross-Domain-Policies` and a `Content-Security-Policy` line. The R1.03 file
|
||
set only `X-Frame-Options` and no CSP.
|
||
|
||
## 4. Displays deployed
|
||
|
||
The operator interface serves displays from
|
||
`%TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\` (`components`, `displays`, `layouts`,
|
||
`locales`, `symbols`, `thresholds`). On a separate CI Portal these must be copied from CI
|
||
Core or another portal, and every portal needs the same copy.
|
||
|
||
```powershell
|
||
Get-ChildItem -Name (Join-Path $env:TLS_WAP_PATH 'cfg\operatorInterfaces\DEPLOY')
|
||
```
|
||
|
||
## Test system (2026-09-30)
|
||
|
||
8080 and 8443 listening (one process), page returned 200, the six `DEPLOY` folders present.
|
||
|
||
## R1.05 test server (2026-10-08, read-only)
|
||
|
||
Steps 1–4 as above: 8080 and 8443 listening (one `javaw.exe` running as the CI Server
|
||
service account), `http://localhost:8080/` and `https://localhost:8443/` both 200, the page
|
||
offers `CI-rc-setup.exe` (Remote Connect), the six `DEPLOY` folders present, and the seven
|
||
headers plus CSP listed above on both ports. Install paths differ from R1.03 (here
|
||
`C:\Yokogawa\CIServer`), so always use the `TLS_*` variables.
|
||
|
||
## R1.05: the CSP blocks external pages in displays (verified 2026-10-09, ISS-111)
|
||
|
||
Tested with a temporary display holding two web browser components on the R1.05 test server
|
||
(removed afterwards). The web client received `Content-Security-Policy: script-src 'self'
|
||
'unsafe-eval' 'unsafe-inline'; img-src 'self' data:; default-src 'unsafe-inline' 'self';
|
||
font-src 'self' data:` and `X-Frame-Options: sameorigin`. With no `frame-src` rule,
|
||
`default-src` applies: the browser refused to frame `https://example.com/` (a
|
||
`securitypolicyviolation` event for `frame-src`), while a page from the CI Server itself
|
||
loaded. So on R1.05 a display with an external web page (a dashboard, a camera, a vendor page)
|
||
stays empty in the browser.
|
||
|
||
**Fix (verified 2026-10-09 on the R1.05 test server):** allow the external host for frames in
|
||
`jwuiisg.sup`, *Security* tab, one `CSP_ENTRY` line per value after the installed ones:
|
||
|
||
```
|
||
CSP_ENTRY = frame-src, "'self'"
|
||
CSP_ENTRY = frame-src, "https://<allowed host>"
|
||
```
|
||
|
||
Keep `'self'`, otherwise pages from the CI Server itself are blocked in frames too. The web
|
||
server `JWUIISG` (started by `user_start.cmd`) reads the file only at start: the change takes
|
||
effect after a CI Server restart (needs administrator rights and disconnects all operator
|
||
clients). Then the header contains `frame-src 'self' https://<allowed host>`, and the test page
|
||
showed inside the display with no CSP violation. List only the hosts you need; to undo, remove
|
||
the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by
|
||
these headers (not tested).
|