Unpacking LTI 1.3 Integration Challenges: A Deep Dive into CSRF and SameSite Issues Impacting Engineering Activity

Understanding the "Cannot Verify CSRF Token Authenticity" Bug in GitHub Classroom LTI 1.3 Integrations

Integrating learning management systems (LMS) like Open edX and Moodle with GitHub Classroom via LTI 1.3 should streamline educational workflows, but a persistent bug has been causing significant friction. Developers attempting to establish these crucial connections are hitting a blocking "Cannot verify CSRF Token Authenticity" error during the OIDC (OpenID Connect) redirect POST, severely impacting engineering activity and developer productivity.

The Technical Root Cause: SameSite=Lax vs. Cross-Site POST

The core of the problem lies in a fundamental incompatibility between GitHub Classroom's session cookie settings and the LTI 1.3 specification's OIDC flow. Here's a breakdown:

• GitHub Classroom's Cookie Setting: GitHub Classroom sets its session cookie, _github_classroom_session, with the SameSite=Lax attribute.
• LTI 1.3 OIDC Requirement: The LTI 1.3 specification mandates a cross-site form POST (resp>) for the authentication response. This means the LMS domain submits a form directly to classroom.github.com.
• Browser Behavior: Due to the SameSite=Lax policy, browsers correctly block the _github_classroom_session cookie from being sent with this cross-site POST request.
• The Consequence: Without the session cookie in the request headers, GitHub Classroom cannot verify the CSRF (Cross-Site Request Forgery) token, leading to a 500 server error.

As clarified by community experts, this isn't an edge case; it's a structural issue. The LTI 1.3 spec's requirement for a cross-site form POST is unavoidable, making the current SameSite=Lax setting a direct impediment to successful integrations. This directly hinders engineering activity for teams trying to deploy and manage these educational tools effectively.

Proposed Solutions and Best Practices

The community discussion highlighted two viable solutions, both requiring implementation on GitHub Classroom's side:

1. Surgical CSRF Exemption:

   The most recommended approach is to add skip_before_action :verify_authenticity_token specifically to the LTI redirect action. This is a targeted fix, disabling CSRF verification only where it's structurally impossible to pass, without affecting other parts of the application. Crucially, the JWT (JSON Web Token) signature itself provides sufficient integrity and authenticity checks for the LTI 1.3 authentication response, meaning no significant security is lost by skipping the Rails-level CSRF check in this specific context.

   # Example (conceptual, for a Rails application)
   class Lti1p3Controller < ApplicationController
     skip_before_action :verify_authenticity_token, only: [:openid_connect_redirect]
   
     def openid_connect_redirect
       # ... LTI 1.3 OIDC processing logic ...
     n end
   end
   

2. Broader SameSite Relaxation:

   Alternatively, GitHub Classroom could set the _github_classroom_session cookie with SameSite=None; Secure. While this would resolve the immediate issue by allowing the cookie to be sent on cross-site requests, it's a broader change. It affects the entire session management, not just the LTI flow, and might have wider implications depending on GitHub Classroom's architecture. Most LTI tool implementations opt for the more surgical first option.

A Long-Standing Challenge for Developer Monitoring Tools and Integrations

This isn't a new problem. Reports of this exact issue, particularly from Moodle users, date back to October 2023 (Discussion #72219) and have continued into early 2026. The detailed technical analysis provided by community members, like Waleed-Mujahid's initial post and Kir4itsu's corroboration, underscores the urgency for an official fix. Such persistent bugs in critical integration points can significantly impede developer monitoring tools and overall engineering activity, as teams spend valuable time debugging and working around fundamental platform limitations.

Addressing this bug is vital for ensuring GitHub Classroom remains a robust and easily integratable tool for educational institutions, fostering smoother engineering activity and enhancing developer productivity across the ecosystem.