The modern WebKit browser engine (WKWebView) supported in SEB for macOS and iOS 3.0 and newer doesn't support sending the Config Key (CK) and Browser Exam Key (BEK) in HTTP headers.
Query the Config Key and Browser Exam Key with the SEB JavaScript API For this, the Config Key generated server-side or saved in the quiz/exam settings has to be concatenated with the requested URL, SHA256 hashed and compared with the value received in the "X-SafeExamBrowser-ConfigKeyHash" header.įrom SEB 3.0 for macOS and iOS and SEB 3.4 for Windows, it's also possible to query the Config Key and the Browser Exam Key using the new SEB JavaScript API. The LMS then can verify the Config Key received in the HTTP request. The header looks like this: "X-SafeExamBrowser-ConfigKeyHash" = 81aad4ab9dfd447cc479e6a4a7c9a544e2cafc7f3adeb68b2a21efad68eca4dc When the option "Use Browser & Config Keys (send in HTTP header)" is activated, SEB adds an additional header to every HTTP request containing the Base16 encoded SHA256 hash of the Config Key concatenated with the requested URL (which protects the key and keeps it secret, since it changes not only for each SEB config but also for each requested URL).
So as soon as LMS/assessment systems will support the Config Key, no manual copy-paste of keys will be necessary for each different config file and SEB version. The most important advantage of the Config Key is, that it can be calculated in an exam system, if that system automatically generates SEB settings for an exam (server-side). But still another version of SEB will calculate the same Config Key for this newly saved config file. The Config Key changes when you alter and re-save a SEB config file.
The Config Key is also same in each platform version of SEB, so SEB for Windows and SEB for iOS will generate the same key as SEB for macOS.