{"record":{"id":"ae496a144637ace3","repo":"instructure/canvas-lms","slug":"error-validating-oembed-token-signature","errorCode":null,"errorMessage":"Error validating oembed_token signature","messagePattern":"Error validating oembed_token signature","errorType":"exception","errorClass":"OembedAuthorizationError","httpStatus":401,"severity":"error","filePath":"app/controllers/lti/concerns/oembed.rb","lineNumber":107,"sourceCode":"    # token was issued\n    def same_user?\n      ContextExternalTool.opaque_identifier_for(@current_user, Shard.current) == verified_jwt[:sub] ||\n        @current_user.lti_id == verified_jwt[:sub]\n    end\n\n    # Returns the validated oembed_token\n    #\n    # The secret used to sign the token\n    # is the shared_secret of the tool who\n    # request the oembed embedding\n    def verified_jwt\n      @verified_jwt ||= begin\n        JSON::JWT.decode(\n          params.require(:oembed_token),\n          associated_tool.shared_secret\n        )\n      rescue JSON::JWS::VerificationFailed, JSON::JWS::UnexpectedAlgorithm\n        raise OembedAuthorizationError, \"Error validating oembed_token signature\"\n      end\n    end\n\n    def unverified_jwt\n      @unverified_jwt ||= JSON::JWT.decode(params.require(:oembed_token), :skip_verification)\n    end\n  end\nend\n","sourceCodeStart":89,"sourceCodeEnd":116,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/app/controllers/lti/concerns/oembed.rb#L89-L116","documentation":"Guard in Lti::Concerns::Oembed#verified_jwt: JSON::JWT.decode of the oembed_token failed signature verification (JSON::JWS::VerificationFailed / UnexpectedAlgorithm) against the associated tool's shared_secret, so the token wasn't signed by the expected LTI tool. This is a sentinel converted into an oembed validation error.","triggerScenarios":"Thrown at app/controllers/lti/concerns/oembed.rb:107 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the tool's shared_secret hasn't changed since the token was issued","Ensure the oembed_token is passed unmodified by the client and signed with the correct algorithm/key"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}