Select the navigation links validation mode

The Navigation Links tab of the Security page allows you to control which external navigation links are allowed in AVEVA PI Vision. You can allow specific protocols, allow specific domains, allow all external navigation links, or block all external navigation links.

Internal links (for example, links to displays) are always allowed.

Select a navigation links validation mode

1. On the AVEVA PI Vision Administration website, navigate to the Security page, then select the Navigation Links tab.

2. Select the navigation link validation mode that you would like to use in your environment:

   • Allow all external navigation links: This mode bypasses all validation of external links. It is not recommended for security purposes.

   • Limit external navigation links to the specified protocols: This or the following mode are recommended for security purposes such as guarding against DNS spoofing.

   • Limit external navigation links to the specified protocols and domains: This mode and the previous mode are recommended for security purposes such as guarding against DNS spoofing. This differs from the previous option in that you can also allow specific domains.

   • Disallow all external navigation links: Only internal links (such as links to displays) are allowed.

3. If you selected Limit external navigation links to the specified protocols and domains or Limit external navigation links to the specified protocols and domains, by default the HTTPS protocol is allowed. If you would like to add another protocol:

   1. Select Add Protocol.

   2. Enter the protocol name, for example, "mailto".

   3. Repeat the previous two steps for each protocol you wish to add. There is a limit of 100 protocols.

      To remove a protocol from the list, select x next to the protocol name. At least one protocol is required.

   Protocols are interpreted as strings and any special RegEx characters are not recognized as such. For example, for the protocol ms-word:ofe|u|file, the pipe character is not recognized as "or," it is just treated as a pipe character. Protocols cannot contain any semicolons and they cannot end in a colon.

4. If you selected Limit external navigation links to the specified protocols and domains, add allowed domains in the Domains section:

   1. Enter the domain name. Note the following:

      • Subdomains are automatically included. For example, if you enter "mydomain.int", "dev.mydomain.int" is also allowed.

   2. To add another domain, select Add Domain. There is a limit of 100 domains.

      To remove a domain from the list, select x next to the domain name. At least one domain is required.

   Domain entries are interpreted as strings and any special RegEx characters are not recognized as such. For example, in the domain example.com, the period character does not signify "any character," it is just treated as a period character. Domain entries cannot contain any semicolons.

5. Select Save.

   Note: Use of the web.config entry NavigationLinkSecurityOverride is deprecated as of PI Vision 2024. PI Vision will ignore any web.config entry for NavigationLinkSecurityOverride.