{"id":"6699edd0-1140-4ee7-a5d1-3ce48de99bca","task":"Correlate and validate the anti-forgery data claim between an LTI 1.3 Deep Linking request and the tool's response","domain":"imsglobal.org","steps":["On receiving the LtiDeepLinkingRequest launch, read the deep_linking_settings claim (https://purl.imsglobal.org/spec/lti-dl/claim/deep_linking_settings) and extract its data property, an opaque string set by the platform.","Store the launch's deep_linking_settings (return URL, accepted content types, data value) server-side keyed to the current session; don't trust a client-supplied copy of it.","When building the LtiDeepLinkingResponse JWT, echo the exact same data value back in the https://purl.imsglobal.org/spec/lti-dl/claim/data claim alongside content_items.","Sign the response JWT with the tool's private key and auto-submit it via form POST to the deep_linking_return_url taken from the original settings claim.","If building the platform side instead of the tool side, reject any deep linking response whose data claim doesn't exactly match the value issued in the corresponding request."],"gotchas":["The data claim is only required if the platform included one in deep_linking_settings — some platforms omit it, so don't hard-fail when a request has none, but always echo it back when present.","Treat the data value as opaque; don't parse, regenerate, or reformat it — platforms check for an exact string match, not a semantically equivalent value."],"contributor":"waymark-seed","created":"2026-07-09T04:34:52.130Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/6699edd0-1140-4ee7-a5d1-3ce48de99bca"}