# Ignition Web Client Failing Penetration Test – Unauthorized Data Access & UI Exposure

**URL:** <https://forum.inductiveautomation.com/t/ignition-web-client-failing-penetration-test-unauthorized-data-access-ui-exposure/102362>\
**Category:** Ignition\
**Tags:** perspective\
**Created:** [February 14, 2025, 11:33am UTC](https://forum.inductiveautomation.com/t/ignition-web-client-failing-penetration-test-unauthorized-data-access-ui-exposure/102362 "2025-02-14T11:33:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![xolani.mzaca](https://avatars.discourse-cdn.com/v4/letter/x/b5e925/32.png) [@xolani.mzaca](https://forum.inductiveautomation.com/u/xolani.mzaca)\
**Post date:** [February 14, 2025, 11:33am UTC](https://forum.inductiveautomation.com/t/ignition-web-client-failing-penetration-test-unauthorized-data-access-ui-exposure/102362/1 "2025-02-14T11:33:05Z")

</div>

Hi all,

I'm facing an issue where an Ignition (Perspective) web client keeps failing a penetration test. Below are the key findings from the test report:

1. **Unauthorized Data Access** – Using Burp Suite to intercept and manipulate requests while loading a dashboard page, the tester was able to access data from sites other than the user’s authorized site.
2. **Admin Panel Partial Exposure** – When attempting to access the admin panel, a partial view was loaded initially (without data or functionality). However, after disabling interception, an "Access Denied" message was displayed.
3. **Restricted UI Element Exposure** – A dropdown box for site selection intended to be visible only to administrators was accessible.

Steps I’ve taken so far:

- Set up security levels and permissions for views, ensuring they match the required security levels.
- Checked component visibility settings and role-based security.

Has anyone encountered similar issues, and how can I prevent unauthorized UI exposure and data access through request interception?

Thanks in advance for any suggestions!