cliu fd2666ddb1 check-web-access: framed pages are fetched by the viewer's browser

Note: an IP allowlist on the target site must include the web-client
viewers; seen on the R1.05 test server (200 from the server, 403 from
another PC).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-09 15:12:07 +11:00

5.5 KiB

Raw Blame History

task	version	source	status
Check web access for CI View (read-only)	R1.05 (first written for R1.03)	IM 36K10R10-01EN §2.2, §3.4, §4.3 (5th Edition, Feb. 2026); installed jwuiisg.sup (R1.05); practiced on the test system 2026-09-30	verified (read-only) on R1.03 (2026-09-30) and on the R1.05 test server (2026-10-08); access from another PC through the R1.05 Access Control settings not tested

Check web access for CI View

Confirms that CI View PCs can reach this CI Portal (or CI Core + CI Portal) node. Nothing is changed. CI Server must be running.

1. Configured ports

$f = Join-Path $env:TLS_ROOT_PATH 'tls\sup\jwuiisg.sup'
Select-String -Path $f -Pattern '^(SECURE_PORT_NUMBER|NON_SECURE_PORT_NUMBER)\b'

Defaults: HTTPS 8443, HTTP 8080.

2. Ports are listening

(Get-NetTCPConnection -State Listen -LocalPort 8080,8443).LocalPort

Both ports should be listed. Nothing listed: CI Server (USER Service) is not running, or the ports were changed.

3. Remote Connect page

(Invoke-WebRequest -UseBasicParsing http://localhost:8080/).StatusCode

Expect 200. This is the page CI View users open as http://<node>:8080/ to download Remote Connect; Remote Connect then uses HTTPS on 8443. From another PC the firewall must allow both ports (skill installation-security). With HTTP_TO_HTTPS_REDIRECT = YES Invoke-WebRequest follows the redirect to HTTPS and may fail on the server certificate; read the HTTP status alone with curl.exe -s -o NUL -w "%{http_code}" http://localhost:8080/ (not tested with YES). If the site has narrowed HOSTNAME_WHITELISTING, a CI View must use one of the listed names (opening the page by IP address may then fail; not tested).

On R1.05 the page also returns the default security headers from the Security tab of jwuiisg.sup (R10 summary §4.3, ISS-111). To see them (curl.exe is part of Windows):

curl.exe -k -s -I https://localhost:8443/

Expect X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, X-XSS-Protection, Cache-Control: no-store, Referrer-Policy, X-Permitted-Cross-Domain-Policies and a Content-Security-Policy line. The R1.03 file set only X-Frame-Options and no CSP.

4. Displays deployed

The operator interface serves displays from %TLS_WAP_PATH%\cfg\operatorInterfaces\DEPLOY\ (components, displays, layouts, locales, symbols, thresholds). On a separate CI Portal these must be copied from CI Core or another portal, and every portal needs the same copy.

Get-ChildItem -Name (Join-Path $env:TLS_WAP_PATH 'cfg\operatorInterfaces\DEPLOY')

Test system (2026-09-30)

8080 and 8443 listening (one process), page returned 200, the six DEPLOY folders present.

R1.05 test server (2026-10-08, read-only)

Steps 1–4 as above: 8080 and 8443 listening (one javaw.exe running as the CI Server service account), http://localhost:8080/ and https://localhost:8443/ both 200, the page offers CI-rc-setup.exe (Remote Connect), the six DEPLOY folders present, and the seven headers plus CSP listed above on both ports. Install paths differ from R1.03 (here C:\Yokogawa\CIServer), so always use the TLS_* variables.

R1.05: the CSP blocks external pages in displays (verified 2026-10-09, ISS-111)

Tested with a temporary display holding two web browser components on the R1.05 test server (removed afterwards). The web client received Content-Security-Policy: script-src 'self' 'unsafe-eval' 'unsafe-inline'; img-src 'self' data:; default-src 'unsafe-inline' 'self'; font-src 'self' data: and X-Frame-Options: sameorigin. With no frame-src rule, default-src applies: the browser refused to frame https://example.com/ (a securitypolicyviolation event for frame-src), while a page from the CI Server itself loaded. So on R1.05 a display with an external web page (a dashboard, a camera, a vendor page) stays empty in the browser.

Fix (verified 2026-10-09 on the R1.05 test server): allow the external host for frames in jwuiisg.sup, Security tab, one CSP_ENTRY line per value after the installed ones:

CSP_ENTRY = frame-src, "'self'"
CSP_ENTRY = frame-src, "https://<allowed host>"

Keep 'self', otherwise pages from the CI Server itself are blocked in frames too. The web server JWUIISG (started by user_start.cmd) reads the file only at start: the change takes effect after a CI Server restart (needs administrator rights and disconnects all operator clients). Then the header contains frame-src 'self' https://<allowed host>, and the test page showed inside the display with no CSP violation. List only the hosts you need; to undo, remove the lines and restart again. The desktop Operator Interface (JCEF browser) is not affected by these headers (not tested).

Who loads the framed page. In the web client the page in a web browser component is fetched by the viewer's own browser, not by the CI Server. So besides the frame-src entry, the target site must accept requests from every machine that opens the web client: a site that only admits the CI Server's address (IP allowlist) answers 403 to the viewers and the frame stays blank or shows an error, although the same display works in the Operator Interface on the CI Server (there the browser runs on the server). Check from a viewer PC with curl -I <url>. The target must also not forbid framing (X-Frame-Options or its own CSP frame-ancestors). Seen on the R1.05 test server 2026-10-09: 200 from the server, 403 from another PC.

5.5 KiB Raw Blame History Unescape Escape