{"record":{"id":"b0314af4e910c69a","repo":"instructure/canvas-lms","slug":"invalid-iss","errorCode":null,"errorMessage":"invalid iss","messagePattern":"invalid iss","errorType":"validation","errorClass":"InvalidTokenError","httpStatus":401,"severity":"error","filePath":"lib/lti/oauth2/access_token.rb","lineNumber":53,"sourceCode":"        new(aud:, sub: decoded_jwt[:sub], jwt:, shard_id: decoded_jwt[:shard_id])\n      rescue Canvas::Security::TokenExpired => e\n        raise InvalidTokenError, \"token has expired\", e.backtrace\n      rescue => e\n        raise InvalidTokenError, e\n      end\n\n      def initialize(aud:, sub:, jwt: nil, reg_key: nil, shard_id: nil)\n        @_jwt = jwt if jwt\n        @reg_key = reg_key || (jwt && decoded_jwt[\"reg_key\"])\n        @aud = aud\n        @sub = sub\n        @shard_id = shard_id\n      end\n\n      def validate!\n        decoded_jwt = Canvas::Security.decode_jwt(jwt)\n        check_required_assertions(decoded_jwt.keys)\n        raise InvalidTokenError, \"invalid iss\" if decoded_jwt[\"iss\"] != ISS\n        raise InvalidTokenError, \"invalid aud\" unless [*decoded_jwt[:aud]].include?(aud)\n        raise InvalidTokenError, \"iat must be in the past\" unless Time.zone.at(decoded_jwt[\"iat\"]) < Time.zone.now\n\n        true\n      rescue InvalidTokenError\n        raise\n      rescue Canvas::Security::TokenExpired => e\n        raise InvalidTokenError, \"token has expired\", e.backtrace\n      rescue => e\n        raise InvalidTokenError, e\n      end\n\n      def to_s\n        jwt\n      end\n\n      private\n","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/lib/lti/oauth2/access_token.rb#L35-L71","documentation":"Lti::OAuth2::AccessToken#validate! checks that the JWT's iss claim equals the constant 'Canvas'. Tokens issued by Canvas always carry iss: 'Canvas'; a mismatch means the token was not minted by this code path or was tampered with, so InvalidTokenError 'invalid iss' is raised.","triggerScenarios":"Calling validate! on a JWT whose iss claim is not exactly 'Canvas' - e.g. a token minted by another issuer, hand-crafted fixtures, or tokens built with a custom/expired iss value.","commonSituations":"Tool vendors passing their own OIDC launch JWTs into this Canvas-internal validator, upgrading Canvas code where ISS changed, or forging test tokens with issuer set to the tool's client_id.","solutions":["Ensure the token was produced by Canvas via Lti::OAuth2::AccessToken.create_jwt / the jwt builder with iss: 'Canvas'","Inspect the token payload (base64-decode) and correct the iss claim to 'Canvas'","If you meant to validate a tool-issued JWT, use the appropriate validator (e.g. AuthorizationValidator or AdvantageAccessToken) instead"],"exampleFix":"# before: custom issuer\nbody = {iss: 'my-tool', sub:, exp:, aud:, iat:, nbf:, jti:}\n# after\nbody = {iss: Lti::OAuth2::AccessToken::ISS, sub:, exp:, aud:, iat:, nbf:, jti:}","handlingStrategy":"validation","validationCode":"iss = JSON.parse(Base64.urlsafe_decode64(jwt.split('.')[1]))['iss']\nraise 'not a Canvas-issued LTI token' unless iss == 'Canvas'","typeGuard":"def canvas_issued_lti_jwt?(jwt)\n  payload = JSON.parse(Base64.urlsafe_decode64(jwt.split('.')[1]))\n  payload['iss'] == 'Canvas'\nrescue JSON::ParserError, ArgumentError\n  false\nend","tryCatchPattern":null,"preventionTips":["Only mint tokens through Lti::OAuth2::AccessToken.create_jwt or the jwt builder with iss: 'Canvas'","Never feed tool-issued JWTs into this Canvas-internal validator","Base64-decode the payload and check iss before calling validate! in tests"],"tags":["lti","oauth2","jwt","issuer"],"backgroundTag":"invalid-identifier","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}