Safe Online Exam documentation
The operator guide for the public Safe Online Exam 1.x release line: what you install, who owns each part, and how to set it up safely.
Safe Online Exam is a public, source-available Canvas LTI 1.3 integration for Safe Exam Browser (SEB). It supports Canvas Classic Quizzes and New Quizzes. Instructors decide which assessments require SEB; students receive a purpose-built configuration; and the Canvas access code is released only after SEB proves it is running the current configuration.
Version 1 is a stable public release line. Install a versioned GitHub Release, verify its checksum and image attestation, and pin the exact published container digest. The project, releases, changelog, security reporting path, and license are at JSB2010/safe-online-exam.
This documentation is the setup and operations guide for the people who stand the service up and keep it running — Canvas administrators, institutional IT, and system administrators. It is not the developer reference for the codebase. It takes you from nothing to a fully working, verified integration, in order.
What you are installing
Three things work together, and you own all three:
- The application — a published Node.js container with PostgreSQL 17 or newer, installed through a Cloud Run or Docker Compose release bundle.
- The Canvas registration — LTI and OAuth developer keys, an installed app, and a small theme script, all pointing at your deployed service.
- The SEB client identity — normally, an encryption certificate whose private half lives only on managed exam devices, so only approved devices can open a configuration. A documented plaintext compatibility mode exists for fleets that cannot distribute that identity; it is not equivalent protection.
Who this is for
Canvas administrators
You manage Developer Keys, external apps, account themes, and OAuth scopes. Sections on connecting Canvas and rolling out are written for you.
Institutional IT / sysadmins
You run the service, the database, backups, and the device fleet. The deploy, operate, and troubleshooting sections are yours.
Assessment / academic-integrity leads
You decide policy — which quizzes are locked down, which tools are allowed. The rollout and usage pages explain the day-to-day surfaces.
How to read this guide
The left navigation is ordered as a path. If you are installing for the first time, follow it top to bottom:
Understand the model
How it works explains the trust and proof model in plain terms, so the configuration choices later make sense.
Plan
Prerequisites is the checklist of access, infrastructure, and decisions to settle before you touch anything. Setup overview is the whole journey on one page.
Install the release
Choose Google Cloud Run or Docker Compose. Both release bundles use a verified, immutable image, generate or collect protected values, run migrations before traffic, and guide the two Canvas handoffs. Then review configuration and, where applicable, certificate management.
Connect Canvas
Create the OAuth and LTI developer keys, install the app, and load the detector script.
Validate and operate
Verify the integration end to end, deploy the certificate to devices when encryption is enabled, and establish operations.
One deployment per Canvas
A single deployment connects to exactly one Canvas tenant and environment. Keep separate service URLs, databases, secrets, LTI registrations, and OAuth credentials for any environments that must stay isolated (for example a test Canvas and a production Canvas). This is the most common source of confusing launch failures — see How it works.
When something breaks
The Troubleshooting section is organized by symptom — what you see in Canvas, the browser console, or SEB — and maps each to the check that resolves it. The reference pages hold the full configuration-variable table, the public endpoint list, and a glossary.