# Gateway Web Page Security **URL:** \ **Category:** General Discussion\ **Created:** [January 29, 2020, 2:03pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714 "2020-01-29T14:03:14Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![davisr19](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@davisr19](https://forum.inductiveautomation.com/u/davisr19)\ **Post date:** [January 29, 2020, 2:03pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/1 "2020-01-29T14:03:14Z")
After a recent upgrade of Ignition to 8.0 I noticed that the gateway web page exposes a lot of parts of Ignition that should be hidden or inaccessible until a user has been authenticated. For example I was able to download and install designer without entering any passwords. I think the Download Designer button should be hidden until the user has logged in to either the status or configure screens. Even exposing the fact that this is an Ignition installation could be useful to bad actors trying to hack our systems. Can we have an option to sanitize the initial gateway web page to only show the login screen until a user has properly logged in? ---
**Author:** ![dkhayes117](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/dkhayes117/32/68344_2.png) [@dkhayes117](https://forum.inductiveautomation.com/u/dkhayes117)\ **Post date:** [January 29, 2020, 2:34pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/2 "2020-01-29T14:34:14Z")
It’s like that in 7.9 too. Seems like you could use the gateway SSL port to help protect the homepage which is 8043 instead of 8088? [https://docs.inductiveautomation.com/display/DOC79/Gateway+Security](https://docs.inductiveautomation.com/display/DOC79/Gateway+Security) ---
**Author:** ![JordanCClark](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jordancclark/32/83362_2.png) [@JordanCClark](https://forum.inductiveautomation.com/u/JordanCClark)\ **Post date:** [January 29, 2020, 2:51pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/3 "2020-01-29T14:51:23Z")
Also, be sure to set Home Page, Designer and Gateway roles in the gateway config. Also also, consider the use of a VPN. If a bad actor gets as far as seeing the gateway, you already have bigger issues. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [January 29, 2020, 5:13pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/4 "2020-01-29T17:13:46Z")
> [@davisr19](#): > > Can we have an option to sanitize the initial gateway web page to only show the login screen until a user has properly logged in? Even better - you can set a [Homepage Redirect Url](https://docs.inductiveautomation.com/display/DOC80/Gateway+Settings#GatewaySettings-GatewaySettings) to return whatever page you want when someone tries to access the homepage. ---
**Author:** ![davisr19](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@davisr19](https://forum.inductiveautomation.com/u/davisr19)\ **Post date:** [January 29, 2020, 6:06pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/5 "2020-01-29T18:06:36Z")
That would be great but then how do legitimate users get back to the gateway page? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 29, 2020, 6:08pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/6 "2020-01-29T18:08:24Z")
I don’t think that’s what you want here. Just set an appropriate role for the Home Page access in the gateway config. ---
**Author:** ![davisr19](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@davisr19](https://forum.inductiveautomation.com/u/davisr19)\ **Post date:** [January 29, 2020, 6:22pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/7 "2020-01-29T18:22:59Z")
We have a role set up for Home Page access and there is still a lot showing on the gateway page, including the button to download designer. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 29, 2020, 6:26pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/8 "2020-01-29T18:26:42Z")
Downloading a Designer is not the privileged operation you think it is. Anyone can download any designer launcher from any Ignition gateway and point it wherever they want. There’s no privileged information there unless they can also log in and have privileges in the designer. ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [January 29, 2020, 6:26pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/9 "2020-01-29T18:26:47Z")
Can you clarify what security risk you consider downloading the designer launcher to be? It’s not something specific to your gateway - it’s a generic application that could be downloaded from any Ignition gateway. Downloading it reveals zero information about your actual gateway. ---
**Author:** ![davisr19](https://avatars.discourse-cdn.com/v4/letter/d/76d3ee/32.png) [@davisr19](https://forum.inductiveautomation.com/u/davisr19)\ **Post date:** [January 29, 2020, 8:11pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/10 "2020-01-29T20:11:01Z")
You are correct in that one still needs to log in after downloading the developer. My bigger concern is exposing the fact that the user has reached an Ignition gateway page. This would be helpful to a hacker if they knew of some vulnerability in Ignition. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [January 29, 2020, 8:16pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/11 "2020-01-29T20:16:47Z")
There is nothing like what you’re asking for, then. (assuming what you’re asking for is a completely bare login screen with zero idenitfying information or graphics) ---
**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\ **Post date:** [January 29, 2020, 8:29pm UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/12 "2020-01-29T20:29:37Z")
It’s also, honestly, a bit of a moot point. Security through obscurity _isn’t_ security. There’s about a thousand ways to determine if an Ignition gateway is running - off the top of my head, they could also scan for the OPC-UA server port, or the GAN port, or check the (also unsecured) `/StatusPing` or `/gwinfo` routes. We’ve had Ignition externally (and publicly) audited multiple times. If you’re concerned about a theoretical zero day, then the actual solution is to minimize the attack surface, IE, use a VPN as @JordanCClark mentioned. Relying on a malicious actor to not attempt an attack just because they don’t _know_ it’s an Ignition system isn’t going to pan out well. ---
**Author:** ![craigb](https://avatars.discourse-cdn.com/v4/letter/c/9f8e36/32.png) [@craigb](https://forum.inductiveautomation.com/u/craigb)\ **Post date:** [January 31, 2020, 2:57am UTC](https://forum.inductiveautomation.com/t/gateway-web-page-security/31714/13 "2020-01-31T02:57:03Z")
> [@davisr19](#): > > That would be great but then how do legitimate users get back to the gateway page? I have the gateway home page redirect set up and then have a sub domain name that points back to gateway. So [mygateway.com](http://mygateway.com) points to [google.com](http://google.com) for example but [xzy123.mygateway.com](http://xzy123.mygateway.com) gets to my real gateway. On top of that I have SSL to include sub domains as I use sub domains to point to different projects and set the user roles as above. The users see [mygateway.com/perspective/project](http://mygateway.com/perspective/project)...... in their browsers but If they try and delete everything after the .com which would get them to the gateway they get directed away. I use our company web site as the re direct landing page. I tried to set up URL masking with the sub domains but couldn’t get it working with SSL. The project would open with the masked URL but non secure, even though the gateway is set to force to SSL. I gave up in the end.