iPad kiosk clock-in web app shows restricted error and wrong redirectSolved

Hi @grace_t ,

For an iPad kiosk web workflow like this, check both the kiosk web app configuration and the iOS browser permissions used by the site.

Recommended checks:

1. Add the correct base URL as a web app in Hexnode

• Create or edit the web app using the main clock-in URL, for example the base domain used for the company kiosk login.
• Avoid configuring only a later redirected URL or a tokenized URL, since those dynamic paths can change after login or employee ID entry.

2. Add the web app to the iOS kiosk policy

• Go to the iOS kiosk policy.
• Add the newly created web app to the kiosk configuration.
• If a web clip is also being used, make sure it points to the same correct base URL.

3. Review Web Content Filtering

• Ensure the required base domain is allowed.
• If the site redirects between related subdomains or uses additional paths after login, those required domains must also be allowed.
• Do not rely on allowing only the final tokenized URL.

4. Reassociate or repush the corrected policy to all affected iPads

• Confirm that all devices are in the intended device group.
• Make sure the corrected kiosk policy is associated with that group or directly with the devices.

5. Check camera permission on the iPads

• On each iPad, open iOS Settings and verify that Safari camera access is allowed.
• If the clock-in workflow uses camera access, denied or unset Safari camera permission can cause repeated prompts, timeout behavior, or failure inside the kiosk web app.

Regards,
Isabel Lora
Hexnode UEM

That makes sense. In our case, two iPads were also showing a camera permission prompt repeatedly, while one did not. All three devices are the same model and assigned to the same Hexnode group. Would the kiosk policy not force that permission automatically?

On iOS, website camera access is still handled through Safari/WebKit permissions. A kiosk policy can restrict the device to the web app, but it does not always silently grant website camera permission for every site interaction.

If one iPad had previously allowed camera access and another had denied or not yet granted it, they can behave differently even with the same Hexnode policy. That explains why identical devices in the same group may show different camera prompts or timeout behavior.

The practical fix is to check the permission state locally on each iPad:

1. Open Settings.
2. Go to Safari or the relevant website permission settings.
3. Set camera access to Allow for the clock-in site.
4. Relaunch the kiosk web app and test the scan or camera step again.

After the permission is allowed, the kiosk web app should stop prompting repeatedly and should continue through the clock-in flow.

Regards,
Isabel Lora
Hexnode UEM