instructure/canvas-lms · error · GraphQL::ExecutionError

Authentication required to view other users' module progress

Error message

Authentication required to view other users' module progress

What it means

In apply_module_filters, when a completion_status filter is requested on a public course by an unauthenticated user (current_user nil) and a user_id is also given, the type refuses to show another user's progress and raises 'Authentication required to view other users' module progress'.

Solutions

1. Authenticate the request before passing user_id in the module filter
2. Omit user_id when unauthenticated (only completionStatus: "incomplete" will return modules)
3. Strip user_id from the filter for anonymous users in the UI layer

Example fix

// before
modules(filter: { completionStatus: "complete", userId: gid })  // anonymous
// after
const filter = currentUser
  ? { completionStatus: "complete", userId: gid }
  : { completionStatus: "incomplete" }

const filter = isAuthenticated ? { completionStatus, userId } : { completionStatus: 'incomplete' }

function canPassUserId(auth) { return !!auth?.current_user }

try { await query(MODULES_QUERY) } catch (e) { if (e.message.includes('Authentication required')) { redirectToLogin() } }

When it happens

Trigger: modules(filter: { completionStatus: ..., userId: ... }) on a public course while not logged in.

Common situations: Public course preview pages rendering module progress with a stale/other-user user_id; anonymous API crawlers passing userId; shared preview links carrying query params into the GraphQL call.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Must be logged in
• Must be logged in
• Must be logged in
• Not authorized to view this user's module progress
• and cannot be used together

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/ff259eae6e2624b4. Report an issue: GitHub.

Appendix: source

Thrown at app/graphql/types/course_type.rb:720

    field :settings, CourseSettingsType, "Settings for the course", null: true
    def settings
      preload_course_permissions.then do
        next nil unless course.grants_right?(current_user, :read)

        course
      end
    end

    private

    def apply_module_filters(scope, filter)
      if filter[:completion_status]
        # Handle unauthenticated users viewing public courses
        if current_user.nil?
          # Unauthenticated users cannot view other users' progress
          if filter[:user_id]
            raise GraphQL::ExecutionError, "Authentication required to view other users' module progress"
          end

          # For unauthenticated users, only "incomplete" filter returns modules
          # All other filters return empty since they have no progress
          case filter[:completion_status]
          when "incomplete"
            return scope # All modules are incomplete for unauthenticated users
          else
            return scope.none # No completed/in_progress/not_started modules
          end
        end

        target_user = if filter[:user_id]
                        User.find(filter[:user_id])
                      else
                        current_user
                      end

View on GitHub (pinned to 1c9f0bb801)