canvas-lms
canvas-lms copied to clipboard
Dynamic Registration Uses Invalid Error Response Body
Summary:
Canvas's dynamic registration response does not match the LTI/OIDC specification for an error response to dynamic registration. OIDC Spec LTI Spec
Steps to reproduce:
- Use tool dynamic registration endpoint that sends invalid parameters to the registration URL
- Receive error response from Canvas
- Observe that the response body does not match the expected parameters
Expected behavior:
A 400 HTTP Status Code with a JSON body formed with at least the following parameters:
{
"error": "invalid_redirect_uri | invalid_client_metadata | *other_code*",
"error_description": ""
}
Actual behavior:
A 422 HTTP Status Code with a JSON body as below:
{
"errors": [""]
}
Additional notes:
Non standard error codes and extra parameters are valid but the message should at least have the expected parameters in the error response as well as use the expected HTTP status code.