Skip to main content

How does whitelisting of URLs work?

Yannick Zwaan
  • Updated

When creating a Schoolyear session, a URL whitelist must be configured for most exams. Schoolyear blocks all URLs by default and only grants access to those that have been explicitly allowed.

If you’re using an integrated testing application or LMS, the URL for the exam is automatically added to the whitelist. In this case, you don’t need to do anything when scheduling an exam.

For each session, you have the option to expand the whitelist, allowing additional URLs to be accessible during the exam. URLs can be added in various ways:

 

  1. When creating a custom exam.

    • The URLs will only be available for that specific exam.

  2. Via the settings widget.

    • The URLs will only be available for that specific exam.

  3. Through a whitelist tile set up in the admin console.

    • The URLs will be available for all exams created via that tile.

  4. Through the global whitelist set up in the admin console

    • The URLs will be available for all exams.

Adding URLs can be done using two methods.

 

Option 1: Regular Whitelisting

Enter the URL you want to add to the Allowlist for this exam in the address bar and click ‘Add.’ Keep the following points in mind when adding URLs:

  • Startpage: The startpage is the first page displayed to the student when Schoolyear launches. This is often the login page or the starting page of the exam. Only one homepage can be set per exam. You can change the homepage by clicking the blue flag icon next to the specific URL.

    • Note: If the exam was created via the exam application (through the integration), the homepage cannot be changed

  • Allow all pages on this domain: When adding an extra URL, you can choose to allow access to the entire website (e.g., all videos on www.youtube.com) or just a single page (e.g., a specific video on youtube.com). By default, the option to allow all pages on the domain is enabled. Move the slider to the left if students should only access a specific URL during the exam.

  • Hidden Redirect URLs: Some websites use multiple URLs when loading a page. During this process, you may be briefly redirected to another URL without noticing it. These are called ‘Hidden Redirect URLs’ and must be added separately to the Allowlist. We recommend testing the URLs first before adding them to the Allowlist for a real exam. For exams created via the exam application through the integration, we have already included the necessary Redirect URLs for you.

Option 2: Advanced Whitelisting

Note: 
Incorrectly configuring this setting may lead to potential exam fraud.

If the regular whitelisting method is insufficient, advanced whitelisting allows you to permit URLs more specifically during the use of Schoolyear. Click on “Advanced URL Patterns” to open the following configuration panel.

By opening this panel, you can configure the following options. For each component, you can use a * if necessary. In the bottom field, you can enter a URL to test whether the new configuration works correctly. If configured correctly, the URL will display in green text. If incorrectly configured, the text will appear in red.

 

Related articles