Please ensure Javascript is enabled for purposes of website accessibility
Powered by Zoomin Software. For more details please contactZoomin

Edge HMI

TABLE OF CONTENTS

Configure the web server for custom widgets

Save PDF
Save selected topicSave selected topic and subtopicsSave all topics
Share
Share to emailCopy topic URL
  • Last UpdatedOct 29, 2026
  • 4 minute read

If you use a web server to serve your project to thin clients, there is an additional step you must take in order to configure that web server for custom widgets.

Before you begin this task, you should be familiar with how to configure and run a web server, such as Internet Information Services for Windows or Apache for Linux.

Also, this task assumes that you have already configured your project for thin client access, that the web server is running, and that your remote users are using any of the standard thin clients. For more information, see Thin Clients (including Mobile Access).

If you are only using the local Viewer module to view your project running on the same computer, you do not need to do anything and you may skip this task.

In short, when a user opens a project screen that contains a custom widget, the widget tries to load its web files from a specific URL. That URL can vary, depending on how you develop and deploy your project, so you must make sure the web server knows exactly where the web files are located on the server. To do that, you will create a direct link from your project's website to those web files.

To configure the web server for custom widgets:

  1. From the Windows Control Panel, run Administrative Tools > Internet Information Services (IIS) Manager.

  2. In Internet Information Services (IIS) Manager, right-click your project's website (see below), and then on the shortcut menu, click Add Virtual Directory.

    • If your remote users are using Thin Clients to access your project, you should have already configured Default Web Site so that its physical path (that is, its root directory) points directly to your project folder. If this is true, right-click Default Web Site.

    • If your remote users are using Mobile Access to access your project, Default Web Site should contain a folder that was automatically created when you installed the Mobile Access Runtime software. For example, Default Web Site > AVEVAEdge2026. If this is true, right-click that folder.

    The Add Virtual Directory dialog box is displayed.

  3. In the Add Virtual Directory dialog box, in the Alias box, type CustomWidget.

  4. In the Physical path box, type the complete file path for your project folder, or click the browse button (…) on the right in order to open a standard Windows file browser that you can use locate and select the project folder.

    For example:

    C:\Users\<user name>\Documents\AVEVA Edge2026 Projects\<project name>

  5. Under Pass-through authentication, click Connect as.

    The Connect As dialog box is displayed.

  6. In the Connect As dialog box, under Path credentials, select Specific user, and then to the right of the box, click Set.

    The Set Credentials dialog box is displayed

  7. In the Set Credentials dialog box, type the user name and password of a Windows user on the computer that has permission to access the project folder.

    By default, the web server only has permission to access the files in the website's own physical path. This is to ensure that visitors to the website do not have unauthorized access to the rest of the computer. Therefore, if you create a virtual directory that points to a location outside of the website's physical path, you need to give the web server permission to access that location.

  8. Click OK to close the Set Credentials dialog box and return to the Connect As dialog box.

    The name of the Windows user is displayed in the Specific user box.

  9. Click OK to close the Connect As dialog box and return to the Add Virtual Directory dialog box.

  10. Click OK to close the Add Virtual Directory dialog box.

    The virtual directory named CustomWidget is added to your project's website.

  11. Exit Internet Information Services (IIS) Manager.

Content Security Policy

Mobile Access sends a Content-Security-Policy (CSP) header with every page, including custom widgets. CSP is a browser security standard that protects against cross-site scripting and data injection by controlling which resources a page can load.

Custom widgets must follow these policies:

  • Do not use inline scripts or event-handler attributes (such as onclick="..."). Put JavaScript in separate .js files.

  • Do not use eval() or new Function().

  • Do not use inline styles. Put styles in separate .css files.

  • Load scripts, styles, and images from the Mobile Access server only, not from external sites.

The header is set in the web server configuration:

  • Windows, IIS: C:\inetpub\wwwroot\AVEVAEdge2026\Web.config

  • Linux, Apache: /etc/apache2/conf-available/iotview.conf

  • Linux, Lighttpd: /etc/lighttpd/conf-enabled/iotview.conf

  • Linux, NGINX: /etc/nginx/fcgiwrap.conf

If a widget must load content from an external source, an administrator can add that source to the policy. For example, to allow a widget to display video from an external site, add frame-src 'self' https://external-source.com;. Relaxing the policy reduces security, it is recommended to thoroughly test any changes.

Related Links