Tsugi Support for User-Agent in Web Service Calls to Canvas

[Chuck Severance]

Hi all,

You may not have heard about this yet but Canvas is enforcing User Agents for API requests on January 17, 2026.

I will have a Tsugi update for this pretty soon and after I test it, I will announce it on this list.

If you are on an earlier branch - the fix should be small and easily back-ported to branches - so check if you are using master or a branch and let me know if you are on aback-level branch and need this fix.

Hope all is well.

/Chuck

[Chris Filkins]

Hi Chuck, and Happy Holidays!

We just wanted to check in on the progress towards addressing this Canvas issue.  I hadn't realized that it would also impact LTI tools :(  I don't think we'll be able to fully upgrade, but plan on backporting.  Thanks!

-Chris 

[Charles Severance]

Clint,

Here is the commit for User-Agent

https://github.com/tsugiproject/tsugi/commit/cd3548149e67275a866fcbefa19a292211bc1f5b

It is really just two files and the changes should be easy to back port.

This is running in my production servers and working fine.

Let me know if it works for you or if you need anything else.

/Chuck

On Dec 2, 2025, at 1:46 PM, Chris Filkins <cfil...@gmail.com> wrote:

Hi Chuck, and Happy Holidays!

We just wanted to check in on the progress towards addressing this Canvas issue.  I hadn't realized that it would also impact LTI tools :(  I don't think we'll be able to fully upgrade, but plan on backporting.  Thanks!

-Chris 

On Wednesday, November 12, 2025 at 12:14:39 PM UTC-5 cs...@umich.edu wrote:

Hi all,

You may not have heard about this yet but  on January 17, 2026.

[Dr. Chuck]

Chris,

I deployed the User-Agent fix for all my servers that talk to Canvas @Umich and a week later, I was off the "No User Agent" audit report.

/Chuck

[Chris Filkins]

Interesting...I just deployed a new Tsugi server with the latest commit, and when I use it with a Canvas environment it immediately showed up on the naughty list.  Are you custom defining a user agent string in your config.php file?  And I'm stumped at the moment as to how I might be able to even test to confirm that Tsugi is setting it on my calls.

-Chris

[Chris Filkins]

@Charles Severance  - I see where you updated the Net.php file, but in LTI13.php there are number of cURL requests (for things like NRPS, which is what I'm using) that aren't setting the user agent.  I'll work on something that I can put together a PR for in the next few days.

-Chris

[Chuck Severance]

That explains it - I don't use NRPS with Canvas - just grade callback - A PR would be most welcome.

/Chuck

[Matthew Jones]

Yeah, I don't use NRPS in Tsugi either.

The good news is that this change for Canvas was pushed back 2 months until March 21st, so there's time to update this code without too much pressure. 

--
You received this message because you are subscribed to the Google Groups "Tsugi Developers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to tsugi-dev+...@apereo.org.
To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/tsugi-dev/97E6FE30-7243-47E2-AB30-87B32D0EF5E2%40gmail.com.

[Chris Filkins]

Thanks Matthew!  That just made my day :)

I have our fixes in place on the LTI13.php file to implement the user agent changes for all of the LTI 1.3 transactions, and will still be planning a pull request next week with those.

-Chris

[Charles Severance]

Tom,

I believe this is already in tsugi and tsugi-php for master:

https://github.com/tsugiproject/tsugi/commit/9111f6c3fd04d689aa8b4fde34ab1dfb9902a539

https://github.com/tsugiproject/tsugi-php/commit/b97a86da39f00b9dafb8f0fa9d4e0bfb1a39aa7c

If you are working in master - the PR process is different.  All PRs need to go to tsugi.   All of tsugi-php has been puled into tsugi in the lib folder.

https://github.com/tsugiproject/tsugi/tree/master/lib

Things are flipped - when I get a PR to tsugi, it is pushed back to tsugi-php through a subtree push so tsugi-php keeps up-to-date.

If you checkout tsugi for your systems, this makes things a lot simpler.  I don’t know of a lot of folks that just use the tsui-php on a composer.json.  Let me knos if you just use tsugi.

If you are back leveled (i.e. far behind master), we might need to do things differently.   Let me know (a) if the existing patches are enough and (b) if you checkout tsugi or tsugi-php and (c) if you hang with master….

Thanks.

/Chuck

On Feb 2, 2026, at 3:25 PM, Tom Reijnders <ajjrei...@gmail.com> wrote:

Hi Chris (and Dr Chuck),

We need the changes to be in the repository. I am happy to create a pull request for LTI13.php. However, just a question. Should that be a PR for the lib reposotory, and than somehow update the reference from the main repo to the lib repo and make a PR for that as well?

Cheers,

Tom

Op vrijdag 9 januari 2026 om 21:53:22 UTC+1 schreef cfil...@gmail.com: