I'm setting up a moodle site, quiz should be taken using safe exam browser but whatever the configuration i put the quiz won't start showing this message:
the config key or browser exam keys could not be validated. please ensure you are using the safe exam browser with correct configuration file.
It works fine when i'm on localhost but it doesn't when i'm online.
I'm using Moodle 3.10 and SEB 3.1.1
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
If you're using the option "upload my own config" in Moodle, make sure to start with a default SEB configuration and not by using some config which was generated earlier or copied from our sample files.
Some older SEB configs contain wrong setting keys which generate a wrong Config Key (allowWLAN is such a wrong key, correct is allowWlan).
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
i haven't used any previous version, I started from default seb config but it keeps showing this message with both "upload my config" and "manual configuration"
Also, it shows a popup where says that i'm not allowed to reconfigure SEB
Last edit: Marco 2021-03-24
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Also, it shows a popup where says that i'm not allowed to reconfigure SEB
When the quiz start page is loaded in a browser, Moodle either starts the quiz if the browser sends a correct Config Key. If the browser doesn't send a Config Key or the Config Key isn't correct, then Moodle sends the SEB configuration, if it detects that the browser is SEB (detected with the browser user agent). But if SEB already received the SEB config for the quiz before (for which the Config Key was calculated wrong by SEB), then SEB cannot be reconfigured again (as it's already running in exam mode), that's why this popup is displayed.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Then there's probably an issue in SEB 3.1.1 or in Moodle 3.10. We will see, if we can reproduce this issue generally (as you say it's also happening with "manual configuration") and if we cannot, we would ask you for a testing access to your Moodle instance.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
Since it works when the start url refer to a localhost instance of the website, but it doesn't work when i put the real web url, there might be some issues with my server blocking some ports/connection needed by SEB?
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
That's actually a good point, thanks for reminding us about the fact that it works on localhost.
SEB doesn't use any special ports between Moodle and the client (it's just a regular browser http/https connection).
But when transmitting the Config Key, the SEB client hashes it with the URL of each HTTP request (the Config and Browser Exam Keys are transmitted in custom HTTP request header fields). Moodle also hashes the key it calculated (or in case of the Browser Exam Key which was copy-pasted into the quiz settings) with the URL of that request and compares those two hash strings.
i think we got the problem, the server it's located behind a proxy i need to check this.
In case i couldn't change proxy settings is there any way to avoid this check or to make it in some different way than using url?
thank you
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I've checked into moodle code and tried to debug from it, when hashing the key and the url i've seen that it uses only the root url (without /mod/quiz etc), is it the expected behaviour?
Last edit: Marco 2021-03-26
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
The full URL of the http request (so the page URL or resource URL has to be used). Currently there is no way to avoid this check. The original Config Key or Browser Exam Key hashes cannot be transmitted as is, otherwise it would be easy to intercept them and use a browser extension to pretend that a correctly configured unmodified SEB is used. Hashing it with the URL hides the real value of the key hashes.
We will work on a new way of transmitting/querying the key hashes now (using a Javascript API). I'll try to figure out to use something else than the page URL to obscure or encrypt the keys. But this will have to be implemented in Moodle as well, so it will surely take several months before it can be used.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
The issue is that, being the server behind a reverse proxy, the full url is not passed to the method which validate the config key, so the validation fails.
I'm going to try some different configuration in order to make it work, thank you for your explanations.
Last edit: Marco 2021-03-26
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
What does the proxy change in the URL, which part of the URL is missing, the host name or a part of it?
We could add a new setting in the SEB clients, where the missing part of the full URL could be indicated. SEB clients would then prefix the URL which is used to validate the Config Key with this URL part from the new setting.
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
i've a url in the form of www.domain.com/prefix/moodle-urls, the proxy removed "prefix" so moodle server didn't know about it.
I solved this by turning off the proxy rewrite url and putting moodle inside a folder called prefix so that the full url matched the server file structure, i also turned off the $reverseproxy options in moodle config.php
If you would like to refer to this comment somewhere else in this project, copy and paste the following link:
I'm setting up a moodle site, quiz should be taken using safe exam browser but whatever the configuration i put the quiz won't start showing this message:
the config key or browser exam keys could not be validated. please ensure you are using the safe exam browser with correct configuration file.
It works fine when i'm on localhost but it doesn't when i'm online.
I'm using Moodle 3.10 and SEB 3.1.1
If you're using the option "upload my own config" in Moodle, make sure to start with a default SEB configuration and not by using some config which was generated earlier or copied from our sample files.
Some older SEB configs contain wrong setting keys which generate a wrong Config Key (allowWLAN is such a wrong key, correct is allowWlan).
i haven't used any previous version, I started from default seb config but it keeps showing this message with both "upload my config" and "manual configuration"
Also, it shows a popup where says that i'm not allowed to reconfigure SEB
Last edit: Marco 2021-03-24
When the quiz start page is loaded in a browser, Moodle either starts the quiz if the browser sends a correct Config Key. If the browser doesn't send a Config Key or the Config Key isn't correct, then Moodle sends the SEB configuration, if it detects that the browser is SEB (detected with the browser user agent). But if SEB already received the SEB config for the quiz before (for which the Config Key was calculated wrong by SEB), then SEB cannot be reconfigured again (as it's already running in exam mode), that's why this popup is displayed.
Then there's probably an issue in SEB 3.1.1 or in Moodle 3.10. We will see, if we can reproduce this issue generally (as you say it's also happening with "manual configuration") and if we cannot, we would ask you for a testing access to your Moodle instance.
Since it works when the start url refer to a localhost instance of the website, but it doesn't work when i put the real web url, there might be some issues with my server blocking some ports/connection needed by SEB?
That's actually a good point, thanks for reminding us about the fact that it works on localhost.
SEB doesn't use any special ports between Moodle and the client (it's just a regular browser http/https connection).
But when transmitting the Config Key, the SEB client hashes it with the URL of each HTTP request (the Config and Browser Exam Keys are transmitted in custom HTTP request header fields). Moodle also hashes the key it calculated (or in case of the Browser Exam Key which was copy-pasted into the quiz settings) with the URL of that request and compares those two hash strings.
Maybe the URL which SEB sees for a HTTP request is different than the one the Moodle server sees? Is the remote Moodle server behind a proxy or another network technology which would change the URL? The URL has to match perfectly, like https://www.example.com/moodle/ isn't the same as https://example.com/moodle/ or https://www.example.com/lms/.
i think we got the problem, the server it's located behind a proxy i need to check this.
In case i couldn't change proxy settings is there any way to avoid this check or to make it in some different way than using url?
thank you
I've checked into moodle code and tried to debug from it, when hashing the key and the url i've seen that it uses only the root url (without /mod/quiz etc), is it the expected behaviour?
Last edit: Marco 2021-03-26
The full URL of the http request (so the page URL or resource URL has to be used). Currently there is no way to avoid this check. The original Config Key or Browser Exam Key hashes cannot be transmitted as is, otherwise it would be easy to intercept them and use a browser extension to pretend that a correctly configured unmodified SEB is used. Hashing it with the URL hides the real value of the key hashes.
We will work on a new way of transmitting/querying the key hashes now (using a Javascript API). I'll try to figure out to use something else than the page URL to obscure or encrypt the keys. But this will have to be implemented in Moodle as well, so it will surely take several months before it can be used.
The issue is that, being the server behind a reverse proxy, the full url is not passed to the method which validate the config key, so the validation fails.
I'm going to try some different configuration in order to make it work, thank you for your explanations.
Last edit: Marco 2021-03-26
What does the proxy change in the URL, which part of the URL is missing, the host name or a part of it?
We could add a new setting in the SEB clients, where the missing part of the full URL could be indicated. SEB clients would then prefix the URL which is used to validate the Config Key with this URL part from the new setting.
i've a url in the form of www.domain.com/prefix/moodle-urls, the proxy removed "prefix" so moodle server didn't know about it.
I solved this by turning off the proxy rewrite url and putting moodle inside a folder called prefix so that the full url matched the server file structure, i also turned off the $reverseproxy options in moodle config.php