Harden an LTI 1.3 tool launch against replay and forged id_tokens by validating nonce, state, and platform JWKS keys.
domain: imsglobal.org · 6 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Generate a unique nonce and state in the tool's login-initiation redirect to the platform's authorization_endpoint, storing state tied to the browser session.
After redirect back, verify the returned state matches the stored session before processing the id_token.
Fetch the platform's JWKS via jwks_uri (never trust an inline jwks array) and verify the id_token signature using the key matching its kid.
Validate the id_token's iss, aud, exp, and nonce claims, confirming the nonce hasn't been seen before within your acceptable time window.
Cache JWKS keys with a TTL and only refetch on a kid cache-miss instead of on every launch.
Track consumed nonces in a short-lived store to reject duplicate/replayed id_tokens.
Known gotchas
nonce (anti-replay for the JWT) and state (anti-CSRF for the redirect) serve different purposes — validate both, not just one.
Refetching JWKS on every request wastes resources and can be abused for DoS against the platform; only refetch on kid miss with rate limiting.
Never trust the unsigned login-initiation request's target_link_uri for final navigation; use the signed claim from the id_token instead.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?