Detector

The detector is the script loaded through your Canvas theme that runs on quiz pages. These symptoms are visible in the browser on a Classic Quiz /take page or a New Quiz assignment route.

Detector never loads

Check, in order:

Retest after any significant Canvas theme, CSP, or quiz-rendering change. Setup details are in Load the detector script.

HTTP 422 on the theme JavaScript file

The browser console shows 422 (ActionController::InvalidCrossOriginRequest) for the uploaded theme file. This is a self-hosted Canvas attachment-serving limitation, not a detector or LTI failure.

Fix: point the account theme's js_overrides at the hosted loader ${TOOL_URL}/js/canvas-seb-theme-loader.js, or configure S3-compatible attachment storage for the durable fix. Full procedure and the one-off recovery command are in Detector script → the local-file (422) case.

Access code is not filled in SEB

The detector loaded, but the code did not appear in the Canvas prompt. This means the release gate did not pass, or the prompt was ambiguous.

Check:

• A fresh configuration was downloaded (a stale one fails Config Key proof).
• The detector loaded on the actual assessment route.
• Config Key proof succeeded — if a protected setting changed, the old configuration no longer proves; download again.
• The Canvas access-code prompt is unambiguous; the detector only fills a clear prompt and never treats page content as authorization.

If proof itself is failing, continue to SEB configuration.

Approved tools are missing, or exit will not trigger

• Tools not showing: approved tools are only exposed after a valid SEB proof. Before proof, they are intentionally hidden — this is not a bug. Confirm proof succeeded and the tool is enabled for this assessment.
• A disabled tool still loads: the detector sidebar is only an affordance; the SEB URL filter in the configuration is the control. Confirm the configuration is current — a settings change requires a fresh download.
• Exit does not trigger: the detector waits for Canvas-authored completion — a successful Classic Quiz submission result, or the New Quiz authoritative result UI. If a submission was cancelled, no exit begins, by design. Unbound manual/auto quit routes deliberately return 410; only a completion-bound exit grant shows the quit link.

Enabling detector diagnostics (non-production)

On a non-production deployment you can set APP_DETECTOR_DIAGNOSTICS_ENABLED=true to stream sanitized detector detail (URLs, iframe origins, gate decisions) for debugging. The production profile rejects this — do not enable it on a prod deployment.