Is this a legitimate Canvas link/domain?

[gloney]

In trying to keep some of our students on task during the day, we have built an allow list only group so they can go to school related sites but nothing else.

As part of the allow list, we added everything on the allow list we found in the community: https://community.canvaslms.com/t5/Canvas-Resource-Documents/Canvas-Domain-Email-and-Server-Manageme...

That seems to be working well, but we have a student repeatedly trying to access a link with a domain not on the list. The domain contains the word canvas which has me wondering if it is a legitimate Canvas link

This is the end of the link that is getting blocked .cluster247.canvas-user-con...launch

Is that a legitimate Canvas domain?

[James · Accepted solution]

@gloney 

The server you gave, a1094-135786059.cluster247.canvas-user-content.com, is matched by the first item on the resource page you linked to.

Under Canvas Core Domains > Browser Security, the item is *.canvas-user-content.com.

The * in front is a wildcard. It allows anything as long as they end in .canvas-user-content.com. It does not require that there be a single hostname in front of the suffix, it can be a hostname with a subdomain as in this case. As long as it ends with the .canvas-user-content.com then it is okay.

As the name suggests, the content on this server has been uploaded by a user.

[gloney]

Thanks 🙂 I was getting confused by the way the link was showing up in our filter, GoGuardian. .cluster247.canvas-user-con...launch

Some of our students have become experts in creating similar urls in hopes of getting past poorly done wildcarding so when I saw this one ending in user-con...launch I was suspicious, but the actual link is user-content.com so that makes sense.

Though the actual link has lots of info after the canvas-user-content.com so thinking I need to adjust the wildcard to be *.canvas-user-content.com/*

I'll give that a shot and see how it goes.

Thanks for your help,

Gary