Safe Exam Browser - iOS Release Notes

Release notes for Safe Exam Browser version 3.2.2:

Now displaying camera & microphone permission dialogs for web applications and optional built-in proctoring before starting session.
Added new settings browserMediaCaptureCamera and browserMediaCaptureMicrophone (Settings / Browser Features / Media Playback/Capture / Allow Camera/Microphone Capture) for controlling browser access to camera/microphone (WebRTC or still pictures/audio recording). If these settings are enabled, users will be asked to grant access to camera/microphone for SEB before the according (exam) session is started.
To access camera/microphone, SEB must use the modern WebKit browser engine. If you're using an assessment software with a built-in SEB integration, make sure to use a version which is compatible with the SEB JavaScript API (for example Moodle 4.1/4.0.6 or updated plugin for manual installation in Moodle 3.9 or later).
Improved MDM configuration to better recognize configuration changes.
Fixed crash when configured via MDM: This happened when a config contained prohibited processes.
Fixed crash when a web page tab is close by Javascript (when using modern WebView).
Fixed file name of shared config file in iOS was not reset together with all other settings.
Fixed additional stability issues.

Optional features which need to be individually configured and are disabled by default:

Massively improved error handling when connecting to SEB Server with better error messages which can help SEB Server and exam administrators to fix server-side issues.
Added support for fallback option when connecting to SEB Server fails completely. In that case, an alternative start URL can be configured and fallback optionally protected with a new fallback password.
Improved stability in case of misconfigured SEB Server exams.
Improved sending log events, to prevent loosing single events due to temporary connectivity issues.
Now sending device info to SEB Server earlier in the connection process.
Renew expired SEB Server OAuth token.

Release notes for Safe Exam Browser version 3.1.1:

Added support for iOS 16.
Added all current major iOS version numbers to the setting 'Allow running from iOS version'.
Allows to use VPN for Automatic Client Configuration by searching the network.
Now asking for local network access permissions in Initial Configuration Assistant.
Added warning about wrong format of institution URL in Initial Configuration Assistant.
Fixed an issue when subsequent scanning of QR codes wasn't possible.
Fixed iFrame contents not displayed.
Fixed media continues to play after the originating browser tab is closed in modern WebView.
Fixed error when connecting to SEB Server (optional, needs to be configured individually) and the "expires_in" attribute in the Oauth token response is missing. Added proper optionality to other attributes in this token response JSON.
Fixed stability issues.

Release notes for Safe Exam Browser version 3.1:

Added text search for web pages (Note: Search in PDF files is currently not supported).
Added key shortcuts for reload (command-R), text search (cmd-F) and quitting exam session (cmd-shift-Q).
Added settings for default page/text zoom.
Added UI controls for zoom page in/out.
Improved SEB JavaScript API, which is compatible with the improved Safe Exam Browser integration in Moodle 4.0.x. This allows to use WebRTC camera and microphone access in Moodle.
Improved persisting of session cookies from WKWebView to WKWebView to avoid unexpected logout of the user on some websites.
JavaScript text input panel is now supported.
Now stopping media playback when closing tab or quitting session (including fullscreen and PiP) in modern WebView when running on iOS 14.5 or newer.
Fixed crash when starting SEB using an sebs:// link.
Improved displaying of PDF files.
Fixed a security issue with screen capturing.
Fixed an issue with Config Key and InAppSettings.
On iOS 15, the new WebRTC permission API is used to prevent the repeated permissions dialog for a website to use camera/microphone access.
Added automatic reload when web content process terminated in modern WebView
Settings 'Enable JavaScript' and 'Block popups' are now supported
Improved stability.
SEB for iOS is now also localized for German.

Optional features, which need to be individually configured and are disabled by default:

Now supporting battery monitoring with SEB Server.
Added lock screen notifications and unlock by SEB Server.
Now sending operating system/device type information to SEB Server.
Now supporting OpenOlat and Ans together with SEB Server.

Release notes for Safe Exam Browser version 3.0.1:

SEB 3.0.1 runs by default on iOS/iPadOS 15. It's not necessary to set the option in Settings / Security / Allow Running on iOS Beta to iOS 15.
Fixed that a custom user agent and suffix wasn't updated when reconfiguring SEB.

Release notes for Safe Exam Browser version 3.0:

Support for the modern WebKit browser engine, which increases performance, stability and compatibility with web applications.
Access to camera/microphone via WebRTC on iOS 14.3 or newer.
SEB 3.0 for iOS can now also be started with seb(s) links to servers requiring authentication.
With the SEB integration in Moodle 3.9 or newer, you can now use the "Launch Safe Exam Browser" button to open the quiz in SEB for iOS.
SEB JavaScript API, currently for querying app version details, ConfigKey and BrowserExamKey security elements.
Fix for "Back to Safari" button/link function in visible Status Bar on iOS 14 before 14.5 in AAC kiosk mode.
SEB doesn't show context menu on phone numbers detected by the web view anymore.
Full support for Basic Authentication (+Digest+NTLM) for seb(s) links and in WebViews (in classic WebView, set the key sendBrowserExamKey=true or use embedded certificates).
The modern WebKit browser engine (WKWebView) currently doesn't support URL content filters and sending the Config Key and Browser Exam Key in HTTP headers (the latter feature will not be possible with WKWebView at all, so you will need to transition to the SEB JavaScript API). If one of these settings (sendBrowserExamKey=true or URLFilterEnableContentFilter=true) is enabled, the classic WebView is used depending on the new setting Browser Features/"Select Browser Engine Policy" (key browserWindowWebView), "Prefer Modern in New Tab+Different Host" (value 2), ensures that you still can use testing systems/LMS like Moodle which use the Browser Exam/Config Key test for SEB connecting to the exam (as they open in the classic WebView), but webpages opened in new tabs, which have another host than the exam system, open in WKWebView.

SEB JavaScript API:
Function void SafeExamBrowser.security.updateKeys(function callback)
This function needs to be invoked first (for example in <body onload="...">). Indicate a callback function (see this demo page) as parameter, which will be called asynchronously by SEB after updating the variables below:
Variable SafeExamBrowser.security.browserExamKey
Variable SafeExamBrowser.security.configKey
which are the BEK and CK hashed with the URL of the page. The keys are identical to the ones send in the HTTP request header when the classic WebView is used. Use this new JS API in an assessment web app with BEK/CK and WKWebView. Also set the key browserWindowWebView to the policy "Prefer Modern" (value 3).
Variable SafeExamBrowser.version with format appDisplayName_iOS_versionString_buildNumber_bundleID
This variable is set regardless whether updateKeys() is called.

Optional features, which need to be individually configured and are disabled by default:

Live remote proctoring using the free, open source video conferencing solution Jitsi Meet.
AI (machine learning) supported proctoring detects if candidates disappear from the camera view or if other faces show up. Also suspicious face movements are detected and displayed with warning symbols in the video stream. The face tracking features work on-device and respect privacy.
Support for SEB Server: In the web backend of SEB Server, an administrator can import exam metadata from a learning management system (LMS) and create SEB Server exams. The list of current exams is then displayed on the SEB clients connected to this SEB Server instance. During the exam, the clients can be monitored in the SEB Server web backend, SEB can be quit remotely etc.
Both Jitsi remote proctoring and SEB Server require examination administrators to set up their own server instances (or use external service providers) and configure SEB clients to connect to those servers. SEB doesn't use any centralized server instances and the according features are by default disabled.

Release notes for Safe Exam Browser version 2.1.17:

SEB 2.1.17 runs by default on iOS 14, removed check for running on iOS beta.
New scroll lock button for better usability while using some drag-and-drop and drawing question types.
Now displaying a disclaimer about the requirement to add an issue description before sending log files to the SEB developers in the integrated mail composer.
Now writing SEB and iOS version and device info into log files.
Fixed that a different Config Key was calculated on iOS 9/10 than on iOS 13/14 with some rare configuration files containing a deprecated setting.
Error message in case AAC couldn't be started properly and device needs to be restarted will only show on iOS versions older than iOS 13.0.
Fixed that SEB assumed an opened URL could be a Universal Link if decrypting the config from that URL failed.
Fixed a common crash when the "Search Network" button in the Initial Configuration Assistant is tapped.

Release notes for Safe Exam Browser version 2.1.16:

Improved accessibility when using VoiceOver: Added accessibility labels and hints to buttons and excluded unnecessary UI elements. After opening the left side menu, VoiceOver focus moves to the first browser tab entry
Added keyboard shortcut Cmd-M to toggle left side menu (show/hide).
Now supporting hardware keyboard shortcuts (Ctrl-Tab/Shift-Ctrl-Tab) to switch browser tabs.
Improved reconfiguration with MDM Managed App Configuration by changing policy when to reconfigure with MDM settings:
1. When reconfiguring (back) to client settings
2. When opening in-app settings, SEB indicates if MDM settings were received and asks if those should be applied.
3. When SEB is running with client settings, there is only one browser tab (with the exam web page) open and the current URL (still) is the Start URL. Please note that this won't work if your Start URL redirects to another page.
4. When secure client settings were quit and SEB is waiting to start another session.
5. When opening SEB or returning back to the SEB app, cases 3 or 4 apply or in-app settings are open (user is asked if MDM settings should be applied).
Added new option to lock SEB when it's attempted to capture the screen, for example when connecting it by cable to a Mac and using QuickTime Player.
Added new option to lock SEB when closing an iPad case on iOS <13, as the displayed iOS lock screen could contain a cheat sheet. Before unlocking, exam supervisors/proctors should check if the lock screen wallpaper of the device is displaying a cheat sheet. Then they can unlock SEB by entering the quit/unlock password. This lock screen is controlled by the new setting mobileSleepModeLockScreen (InAppSettings: Security / Lock Screen After Sleep Mode).
Implemented separate settings to control clearing cookies when starting/ending session (keys examSessionClearCookiesOnStart / examSessionClearCookiesOnEnd). This allows users to stay logged-in, for example when logging in after SEB was started with client settings and then an exam with individual settings is started in some learning management and exam systems. This prevents security issues with users staying logged-in after reconfiguring SEB with new settings, if this wasn't actually intended.
Fixed issues when calculating the Config Key hash with specific settings. Compatible assessment systems can use this hash value to automatically verify that an exam is accessed with correct settings.
Allow to open SEB config files from iCloud Drive (using Files app). In previous versions, the file needed to be downloaded manually before opening it in SEB.
Fixed that the URL filter didn't treat query strings consistently between SEB versions on Mac and Windows.
Fixed client configuration encrypted with password wasn't compatible between the iOS/macOS and the Windows SEB versions.
Fixed setting Browser Features / "Show URLs: Always" couldn't be selected in In-App-Settings and activating this option wasn't showing the page URL in the side menu.
If checking server trust with embedded certificates, resources in subdomains of already trusted domains are now trusted as well, according to behavior in other web browsers.
Replaced key string mobileShowSettings with string showSettingsInApp in default settings.
Added error message in case AAC couldn't be started properly on older iOS versions, suggesting to restart the device.
Changed left side menu "SafeExamBrowser version number" title to a button which closes the side menu for better accessibility.
Activated text scaling (Dynamic Type) for most UI strings (currently commands in the left side menu are not yet scaled, this will be added in a later version).

Release notes for Safe Exam Browser version 2.1.15:

Runs on iOS 13 with default settings (without having to set the "Allow Running on iOS Beta" option in Settings/Security to iOS 13).
It's now possible to start an exam with individual settings or to reconfigure SEB even if using client settings with a quit password, as long as no exam is running.
Tapping Cancel in the "No Kiosk Mode Available" alert now displays the "Exam Session Finished" alert instead of asking to activate AAC Single App Mode immediately again.
Fixed that a Quit Link with a trailing slash didn't work.
Now clearing cookie store when starting SEB, to prevent that some authentication logins persist.

Release notes for Safe Exam Browser version 2.1.14:

‪The Browser Exam Key and the new Config Key values are generated by SEB for iOS and sent with all HTTP requests (if enabled in Settings/Exam Session). Compatible assessment systems can use these values to verify if an exam is accessed with an approved version of SEB and deny access if a regular browser is used, if SEB is used with wrong settings or if a manipulated version of SEB is used.‬ ‪
SEB for iOS now supports the URL filter feature to restrict access to websites/web pages/web resources. Use the desktop versions of SEB to generate config files containing URL filter rules.‬
SEB now uses the full native resolution when running on iPad Pro devices with Face ID.‬ ‪
SEB now supports Slide Over and Split View on compatible iPads when not running in Single App Mode (for open book exams or when using other apps in exams on managed devices).‬
Added option "Allow Picture in Picture Video". On iPad devices supporting PiP, the video plays in a movable and resizable overlay window. If not running SEB in Single App Mode (open book exams, using other apps in exams on managed devices), PiP video keeps playing even if switching to other apps.‬
Added option to allow media auto play. By default media doesn't auto play, unless you allow it with the option Settings/Browser Features/Media Autoplay.‬
Added options to control if video can be played inline on a web page or only in full screen. There are two separate settings for "Allow Inline Playback on iPad" (enabled by default) and "Allow Inline Playback on iPhone" (disabled by default) in Settings/Browser Features. By disabling this option, HTML5 video players are forced to use the iOS user interface for controlling playback. ‬
SEB for iOS now saves log files, which can help when analyzing issues. Those logs can be emailed to the SEB developers or to an exam administrator.‬
Setting for log level is now functional (Settings/Security/Logging/Log Level).‬
Improved reliability of MDM Managed Configuration, important for iPads owned, deployed and managed by institutions.‬
Added iOS 13 to the "Allow Running on iOS Beta" option.‬
SEB for iOS now optionally supports downloading files (Settings/Downloads/Allow Downloading). Currently only website generated files (using the data: scheme) can be downloaded. This feature allows saving encrypted exam results in case network connection fails. Such downloaded files can be accessed in the Files app ("On My iPad/iPhone" location) and with iTunes.‬
Added support for encrypting SEB config files with identity certificates. These certificates have to be distributed to exam devices by embedding them into a client config file. SEB exam config files encrypted with this certificate can afterwards be opened without students having to enter an SEB exam settings password.
New identity certificates for encrypting and decrypting config files can easily be created in Settings/Network/Certificates/Choose Identity.‬
Added option to automatically create and embed an identity certificate (Settings/Config File/Create & Embed Identity, available when editing client config files). ‬
Option to auto-select latest created or imported identity for encrypting exam configs (Settings/Config File/Auto-Select Identity).‬
Added options for links requesting to open in new tab: open in same or new tab, always block or block when on another server. See Settings/Browser Features, this functionality is compatible with SEB for macOS.‬
The Quit Link feature can now optionally restart an exam session instead of quitting it (Settings/Exam Session/Restart Instead of Quitting).‬
Exam sessions can now optionally be reconfigured before having to first quit the running exam session (Settings/Exam Session/Allow Reconfiguring).‬
Clearing of session cookies can now optionally be disabled, allowing users to stay logged in if they already were in a previous session (Settings/Exam Session).‬
Deep linking for exams now also works with sebs:// links (in addition to Universal Links, see Settings/Exam Session/Allow Deep Linking for Exams)).‬
Stability and security improvements.
SEB 2.1.14 fixes an issue in SEB 2.1.13 which occurred when checking app integrity.

Changes:

IMPORTANT: SEB 2.1.14 for iOS uses a different policy to decide if it can be reconfigured when a seb(s) URL or a .seb config file is opened: When running in secure mode (a quit password is set in the currently active settings, which invokes AAC/the selected Single App Mode), SEB 2.1.14 cannot be reconfigured, even if it's using persisted client settings. Earlier versions could always be reconfigured when using client settings. If you want to allow reconfiguring SEB by opening a seb(s) URL while running in secure mode, then you need to use the "Allow Reconfiguring" and "Reconfiguring Config URL" options in Settings/Exam Session. This new policy for reconfiguring will also be introduced to upcoming desktop versions of SEB.

Release notes for Safe Exam Browser version 2.1.12:

SEB is now running on iOS 12.
Supports full screen size on all new iPhone devices.
The Initial Configuration Assistant now allows to search the local network for SEB settings by just tapping a button (when an institution supports this feature).
Improved information for users in some of the dialogs displayed when configuring SEB and finishing an exam.
QR codes can now contain an optional query string, for example to identify a specific user or exam.
Specific assessment systems can be accessed using Universal Links:
A regular web link to a supported system opens directly in SEB.
If the user doesn’t have SEB installed yet, the link opens in Safari and a smart banner shows a button to install SEB from the App Store.
Using deep linking, SEB can open direct links to all pages of a website.
Universal Links also work with QR codes: You can print one QR code which users can scan with the camera app (starting with iOS 11). This will then allow examinees to install SEB and start an exam on your system with just one QR code.
On supported systems, users can log in with their passwords saved in iCloud Keychain.
The title of the currently visible webpage tab is displayed underlined in the left side menu.
Fixed a hyperlink compatibility issue. This solves problems with some website features previously not working in SEB for iOS.
Fixed a security issue when accessing the settings editor.
SEB for iOS now can use embedded TLS and CA server certificates and certificate pinning for higher security when accessing exam servers. Use config files saved in the SEB versions for supported desktop platforms.
You can configure a minimum required iOS version. SEB will then refuse to run on an older iOS version, for example for security reasons and to ensure availability of latest web technologies in the iOS WebKit browser engine.
New setting for a browser user agent suffix, which is appended to all regular user agent strings.
Stability and security improvements.