What is reachable without a password

NEXT HMI has one password for the people who engineer the system, the device-admin password, and none for the operator screens. This page lists what someone who can reach the device on the network can see and do with no password at all, what each credential adds on top, and how to place the device so that is what you want.

In short

• Anyone who can reach the device can do everything a running project's screens can do. They can see every live value, write every writable variable, load and save recipes and acknowledge alarms, whether or not anyone is signed in. Signing in on a screen changes what the screens show and who an action is recorded as. It does not change what the server accepts.
• Everything else needs a credential: the dashboard, the editor, the project's settings, users and tokens, the datasource settings, the API and the MCP endpoint.
• So the network is the fence. On an isolated machine network that is exactly what an operator panel needs. On a network shared with office PCs, laptops or visitors, every device on it gets the operator's reach.

When it matters

Open to anyone who can reach the device

A running project's screens

Everything under /runtime/<project>/, while that project runs:

Anyone who can reach the panel can write the writable variables. There is no per-variable list of who may write. To stop someone changing a value, block or hide the button that writes it for their group (see Gate what a group can see and do), and mark a variable read-only in its datasource when no screen needs to write it. A blocked button stops the person at the panel, not a script on the network.

A sign-in sent to a panel name goes to whoever opens that name. When another system signs an operator in on a named panel over the API, every screen opened with that ?panel=<name> receives the sign-in. The name proves nothing about which screen it is. See Panels: sign users in and out.

The manager

The manager is the device's front door, at the address without /runtime/…. With no password, someone can:

• open the sign-in page, the user guide at /help, and the health check at /api/health;
• open the default project's screens: the bare address goes there when a default project is set and running;
• see whether a device-admin password has been set;
• try the device-admin password: on the sign-in page, when pairing an MCP client or another NEXT HMI device, or over the API. Five wrong passwords from one address lock that address out of all of them for a minute, while other devices can still sign in; a hundred wrong passwords within a minute from all addresses together lock everyone out for a minute;
• see that the device exists: it announces itself on the local network so other NEXT HMI devices can find it for a project transfer.

What needs a credential

A device-admin password must be at least 8 characters when it is set or changed; one set before this rule keeps working until it is changed.

A sign-in on the dashboard lasts 24 hours, or until that browser signs out. The device keeps track of every sign-in, so signing out ends it on the device too, and a copy of the browser's sign-in cookie stops working at the same moment. Settings › Security › Sign out everywhere ends every browser's sign-in, your own included, and turning HTTPS on ends them all: a sign-in made over plain HTTP has crossed the network readable. MCP, API and peer tokens are not sign-ins and keep working through both. Changing the device-admin password ends every sign-in but your own, and revokes those tokens too.

What protects the open part

• Other websites cannot use it. A web page from another site, open in a browser on the panel or on a laptop on the same network, cannot connect to the live screens or send them changes: the device refuses a browser request whose page did not come from the device itself. Nor can it show the screens inside a frame of its own, where a disguised button could trick someone into a click that writes a setpoint: only the device itself and the sites you list may do that (see Showing NEXT HMI inside another site).
• That check stops websites, not scripts. A program on the network (curl, a Python script, a PLC tool) sends no page address, and gets the same reach as a panel.
• DNS rebinding gets past the check. A website that points a name of its own at the device's address looks to the device like the device itself. It still reaches only the open part: the browser does not send the dashboard sign-in to that name, and the projects running behind the device answer only the device itself, never a name. On a new install it cannot set the device-admin password either: that takes the setup code, which only the device's console and log show.
• Other programs on the device go through the front door too. Each running project listens on the device's own internal address only, and answers only requests that carry a secret the device gave it when it started. Another program or user account on the same machine that finds it gets nothing, and cannot take its place to receive the screens' traffic.
• Files in the project folders run no script. An HTML or SVG file in assets or custom-widgets, opened at its own address, shows as a plain document, so a file someone put there cannot act with your dashboard sign-in. Custom widgets and external libraries are code the screens run on purpose and are not limited this way.
• Sign-ins are throttled, per username and per address on the screens (see Users), and per address for the device-admin password and the setup code everywhere.
• The open part takes at most 1 MB per request. The device refuses a larger request before reading it, so no amount of data sent its way can exhaust the device's memory and take the screens down. An HTTP source whose request is over that is not sent, and the screen says so.
• A project serves at most 500 open screens at once. One more is turned away and its browser tries again every 10 seconds, so no flood of connections can wear down the device or the PLC behind it. The editor is never turned away.

Showing NEXT HMI inside another site

By default only the device itself can show its pages in a frame; another site that tries gets an empty frame. When a plant portal or another web page must show NEXT HMI inside its own page, add it under Settings › Sites that may embed NEXT HMI on the dashboard, as the address the portal is opened at: scheme, host and, when it is not the default, port, such as https://portal.example.com or http://10.0.0.20:8080. A path, a wildcard or anything else is refused. The change applies the next time the page loads; no restart.

Up to 32 sites can be listed. Every page of the device carries the list, and one long enough would make browsers refuse to load any page, so saving a longer list is refused with a message saying how many it has; in a file edited by hand, the sites past the 32nd are ignored.

Embedding is meant for the runtime screens, at /runtime/<project>/. The dashboard and the editor do not work inside another site's frame: the browser does not send their sign-in cookie to a page framed by a different site, so they cannot stay signed in there. Open them directly, at the device's own address.

A listed site can frame every page of the device, the screens of every project included, so list only sites you control: whoever controls one can lay a disguised page over your screens.

Network advice

• Give the HMI its own network segment (a VLAN) and let the firewall pass only the panels and the engineering PCs to its ports (8000, and 8443 with HTTPS on).
• Turn on HTTPS wherever the network is not yours. Over plain HTTP the device-admin password, every operator sign-in and every token cross the network as readable text.
• Never put the device on the public Internet. Reach it from outside through a VPN.
• Behind a reverse proxy, pass the browser's Host header through with its port and send X-Forwarded-Proto, or the device refuses every change and every live connection. A proxy on another host must also be listed in NEXTHMI_FORWARDED_ALLOW_IPS. See Behind a terminating proxy.
• The full threat model is in Network placement and threat model.