SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

LTI Integration Bug Fix: User Identity Should Be Tied to 'sub' Claim, Not Email

0
·1 views

A critical bug was discovered in a CircuitVerse LTI 1.3 integration where users were being identified by their email address rather than the stable 'sub' claim in the id_token, a flaw that passed all standard tests but posed a real security risk. The fix scopes identity using a combination of deployment ID and the sub claim, preventing cross-institution collisions where two users at different institutions could share the same sub value. A separate issue arose because Canvas POSTs the id_token as a cross-site request, causing browsers to block SameSite=Lax session cookies and breaking the login flow; the temporary fix was to set SameSite=None on the session cookie. The developer also added a self-referential parent_group_id field to the existing Group model to support subgroups, avoiding the complexity of introducing a separate Subgroup model. Upcoming work includes properly replacing the SameSite=None cookie change and closing two open pull requests.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developers Debate: Established Platforms vs. Fast-Moving Indie Alternatives

A developer on DEV Community has posed a question to the developer community about whether they would prefer a large, established platform with millions of users or a smaller, indie alternative that ships updates rapidly and responds to feedback within hours. The discussion centers on the challenge new software products face in gaining user trust, even when they offer superior responsiveness and transparency. The author observes that most developers default to tools they already know, making it difficult for newer products to gain traction regardless of their quality. They are considering building a product based on open-source principles, public development, and community-driven features, and are seeking honest input on what would motivate developers to switch. The post invites candid responses, including from those who would not consider switching from an established platform under any circumstances.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developers Build Two-Armed Robot Simulation Using ALOHA and MuJoCo via Single Prompt

A developer walkthrough on DEV Community demonstrates how to set up a bimanual manipulation simulation using Stanford's open-source ALOHA robot platform inside the MuJoCo physics simulator. ALOHA, which stands for A Low-cost Open-source Hardware System for Bimanual Teleoperation, features two arms sharing a workspace and is widely used in robotics manipulation research. The scene — including a workbench, open lunchbox, food items, and the dual-arm robot — was generated from a single natural-language prompt using a tool called Drift, eliminating manual scene authoring. The setup replicates real-world tasks like packing a lunchbox, where one arm must stabilize an object while the other manipulates it — a coordination challenge that single-arm robots cannot handle. The article notes that training both arms to cooperate without colliding remains the harder next step in bimanual manipulation research.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Proxy Pattern: How a Surrogate Object Controls Access Without Changing Interfaces

The Proxy Pattern is a structural design pattern that places a surrogate object between a client and a real object to control when and how the real object is accessed. It addresses common performance issues like the N+1 query problem by delaying the loading of heavy objects, such as database relations, until they are actually needed. The pattern shares structural similarities with the Decorator pattern but differs in intent: while Decorator adds behaviour, Proxy manages access. Several variants exist for specific use cases, including Virtual Proxy for lazy loading, Protection Proxy for permission checks, Cache Proxy for storing results, Remote Proxy for network calls, and Logging Proxy for auditing. By intercepting access transparently, the Proxy Pattern allows developers to improve performance and enforce security without modifying existing client code or business logic.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Reddit Powers 93% of AI Software Recommendations, Study of 241 Categories Finds

A researcher conducted a structured experiment across 241 software categories, querying ChatGPT and Gemini with six buyer-style questions each, generating over 5,000 product mentions and tracking every cited source. Reddit appeared as a source in 93% of categories, feeding 1,202 individual answers, while Capterra — a heavily funded software review directory — appeared in only 12%. The study also found that AI recommendations are less consistent than they appear: in 62% of categories, no single product was named across all six answers, suggesting results shift with minor changes in phrasing. Brands with the widest web presence, such as HubSpot (named across 24 categories) and Salesforce (16 categories), were disproportionately recommended regardless of fit. The findings suggest that visibility in community discussions and independent roundups now matters more than optimized profiles on traditional software review platforms.

0 comments Read more at DEV Community
LTI Integration Bug Fix: User Identity Should Be Tied to 'sub' Claim, Not Email · ShortSingh