Tsugi Support for User-Agent in Web Service Calls to Canvas

[Chuck Severance]

Hi all,

You may not have heard about this yet but Canvas is enforcing User Agents for API requests on January 17, 2026.

I will have a Tsugi update for this pretty soon and after I test it, I will announce it on this list.

If you are on an earlier branch - the fix should be small and easily back-ported to branches - so check if you are using master or a branch and let me know if you are on aback-level branch and need this fix.

Hope all is well.

/Chuck

[Chris Filkins]

Hi Chuck, and Happy Holidays!

We just wanted to check in on the progress towards addressing this Canvas issue.  I hadn't realized that it would also impact LTI tools :(  I don't think we'll be able to fully upgrade, but plan on backporting.  Thanks!

-Chris 

[Charles Severance]

Clint,

Here is the commit for User-Agent

https://github.com/tsugiproject/tsugi/commit/cd3548149e67275a866fcbefa19a292211bc1f5b

It is really just two files and the changes should be easy to back port.

This is running in my production servers and working fine.

Let me know if it works for you or if you need anything else.

/Chuck

On Dec 2, 2025, at 1:46 PM, Chris Filkins <cfil...@gmail.com> wrote:

Hi Chuck, and Happy Holidays!

We just wanted to check in on the progress towards addressing this Canvas issue.  I hadn't realized that it would also impact LTI tools :(  I don't think we'll be able to fully upgrade, but plan on backporting.  Thanks!

-Chris 

On Wednesday, November 12, 2025 at 12:14:39 PM UTC-5 cs...@umich.edu wrote:

Hi all,

You may not have heard about this yet but  on January 17, 2026.

[Dr. Chuck]

Chris,

I deployed the User-Agent fix for all my servers that talk to Canvas @Umich and a week later, I was off the "No User Agent" audit report.

/Chuck

[Chris Filkins]

Interesting...I just deployed a new Tsugi server with the latest commit, and when I use it with a Canvas environment it immediately showed up on the naughty list.  Are you custom defining a user agent string in your config.php file?  And I'm stumped at the moment as to how I might be able to even test to confirm that Tsugi is setting it on my calls.

-Chris

[Chris Filkins]

@Charles Severance  - I see where you updated the Net.php file, but in LTI13.php there are number of cURL requests (for things like NRPS, which is what I'm using) that aren't setting the user agent.  I'll work on something that I can put together a PR for in the next few days.

-Chris

[Chuck Severance]

That explains it - I don't use NRPS with Canvas - just grade callback - A PR would be most welcome.

/Chuck

[Matthew Jones]

Yeah, I don't use NRPS in Tsugi either.

The good news is that this change for Canvas was pushed back 2 months until March 21st, so there's time to update this code without too much pressure. 

--
You received this message because you are subscribed to the Google Groups "Tsugi Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tsugi-dev+...@apereo.org.
To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/tsugi-dev/97E6FE30-7243-47E2-AB30-87B32D0EF5E2%40gmail.com.

[Chris Filkins]

Thanks Matthew!  That just made my day :)

I have our fixes in place on the LTI13.php file to implement the user agent changes for all of the LTI 1.3 transactions, and will still be planning a pull request next week with those.

-Chris