instructure/canvas-lms · error · OembedAuthorizationError

Error validating oembed_token signature

Error message

Error validating oembed_token signature

What it means

Guard in Lti::Concerns::Oembed#verified_jwt: JSON::JWT.decode of the oembed_token failed signature verification (JSON::JWS::VerificationFailed / UnexpectedAlgorithm) against the associated tool's shared_secret, so the token wasn't signed by the expected LTI tool. This is a sentinel converted into an oembed validation error.

Solutions

1. Verify the tool's shared_secret hasn't changed since the token was issued
2. Ensure the oembed_token is passed unmodified by the client and signed with the correct algorithm/key

When it happens

Trigger: Thrown at app/controllers/lti/concerns/oembed.rb:107 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of instructure/canvas-lms@1c9f0bb801 (2026-09-15). Data as JSON: /api/errors/ae496a144637ace3. Report an issue: GitHub.

Appendix: source

Thrown at app/controllers/lti/concerns/oembed.rb:107

    # token was issued
    def same_user?
      ContextExternalTool.opaque_identifier_for(@current_user, Shard.current) == verified_jwt[:sub] ||
        @current_user.lti_id == verified_jwt[:sub]
    end

    # Returns the validated oembed_token
    #
    # The secret used to sign the token
    # is the shared_secret of the tool who
    # request the oembed embedding
    def verified_jwt
      @verified_jwt ||= begin
        JSON::JWT.decode(
          params.require(:oembed_token),
          associated_tool.shared_secret
        )
      rescue JSON::JWS::VerificationFailed, JSON::JWS::UnexpectedAlgorithm
        raise OembedAuthorizationError, "Error validating oembed_token signature"
      end
    end

    def unverified_jwt
      @unverified_jwt ||= JSON::JWT.decode(params.require(:oembed_token), :skip_verification)
    end
  end
end

View on GitHub (pinned to 1c9f0bb801)