Student Exam Workflow
Relevant source files
The following files were used as context for generating this wiki page:
- PeP.ExamApp/Pages/LoginPage.xaml.cs
- PeP.ExamApp/Pages/ExamCodePage.xaml.cs
- PeP.ExamApp/Pages/ExamRunnerPage.xaml.cs
- PeP.ExamApp/Pages/AntiCheatPage.xaml.cs
- PeP.ExamApp/Pages/TeacherAuthPage.xaml.cs
- Controllers/ExamAppController.cs
- Services/ExamAppService.cs
- PeP.ExamApp/ExamAppApiClient.cs
- Models/ExamModels.cs
- Models/ProgrammingExamModels.cs
- Data/ApplicationDbContext.cs
- Services/ProgrammingExamService.cs
The Student Exam Workflow outlines the end-to-end process a student follows to take an exam using the secure PeP.ExamApp desktop application. This workflow is designed to ensure a controlled, secure, and fair testing environment. It begins with student authentication, proceeds through multi-factor authorization involving a teacher, runs a series of system security checks, and culminates in the student taking the exam within a hardened web environment.
The entire process is a sequence of UI pages within the WPF application, which communicates with the backend via a dedicated API controller (ExamAppController). This controller uses services like ExamAppService to manage authorization tokens, exam sessions, and attempt creation, ensuring that only validated students can access and start an exam under supervised conditions.
High-Level Workflow
The student progresses through a linear sequence of pages in the PeP.ExamApp. Each step must be completed successfully before proceeding to the next.
This diagram shows the page flow for a student from initial login to launching the exam.
UI Page Summary
| Page | Purpose | Key Actions |
|---|---|---|
LoginPage | Student authenticates with their credentials. | Calls ExamAppApiClient.LoginAsync. |
ExamCodePage | Student enters the unique code for the exam. | Looks up exam details via api.GetExamInfoAsync. |
TeacherAuthPage | A teacher provides their password to authorize the session. | Generates an AuthorizationToken via api.AuthorizeAsync. |
TutorialPage | Displays instructions and rules for the exam. | Student must acknowledge to continue. |
AntiCheatPage | Performs system security checks. | Blocks launch if checks fail (e.g., VM, screen recorder). |
ExamRunnerPage | Hosts the exam in a secure WebView2 instance. | Starts the exam attempt and gets a LaunchToken. |
Sources: PeP.ExamApp/Pages/LoginPage.xaml.cs:33, PeP.ExamApp/Pages/ExamCodePage.xaml.cs:46, PeP.ExamApp/Pages/TeacherAuthPage.xaml.cs:45, PeP.ExamApp/Pages/AntiCheatPage.xaml.cs:81, PeP.ExamApp/Pages/ExamRunnerPage.xaml.cs:51
Authorization and Session Start
The core of the pre-exam workflow is a multi-step authorization process that generates two key tokens: an AuthorizationToken and a LaunchToken. This ensures that a student is not only authenticated but also explicitly authorized by a teacher for a specific exam session.
This sequence diagram illustrates the interactions between the client, API, and services to authorize and start an exam.
API Endpoints
The ExamAppController exposes endpoints to facilitate this workflow.
| Method | Endpoint | Description | Request Body | Response Body |
|---|---|---|---|---|
GET | /api/exam-app/code/{code} | Retrieves public information about an exam from its code. | N/A | ExamCodeInfoResponse |
POST | /api/exam-app/authorize | Authorizes a student for an exam with a teacher's password. | AuthorizeRequest | AuthorizeResponse |
POST | /api/exam-app/start | Starts an exam attempt and generates a single-use launch token. | StartRequest | StartResponse |
Sources: Controllers/ExamAppController.cs:64-111
Pre-Exam Security Checks
Before the exam can be launched, the AntiCheatPage performs a series of security checks on the student's system. If any critical checks fail, the student is blocked from starting the exam until the issues are resolved.
Sources: PeP.ExamApp/Pages/AntiCheatPage.xaml.cs:85-129
| Check | Description | Failure Condition |
|---|---|---|
| Administrator | Verifies the application is not running with administrator privileges. | report.IsAdmin is true. |
| Multiple Monitors | Ensures only one display is connected. | report.MonitorCount != 1. |
| Remote Session | Checks if the user is in a remote desktop session. | report.IsRemoteSession is true. |
| Virtual Machine | Detects if the app is running inside a VM. | report.IsVM is true. |
| Debugger Attached | Checks if a debugger is attached to the process. | report.IsDebuggerAttached is true. |
| Blacklisted Processes | Scans for forbidden applications (e.g., screen recorders). | report.BlacklistedProcesses.Count > 0. |
| Screen Recording | Detects active screen recording sessions. | report.IsScreenRecording is true. |
The page provides an option to automatically close blacklisted processes.
Sources: PeP.ExamApp/Pages/AntiCheatPage.xaml.cs:51-56, 102-104
Exam Execution Environment
Once all checks pass, the student is navigated to the ExamRunnerPage, which provides the secure environment for the exam.
WebView2 Hardening
The exam content is loaded from the web application into a Microsoft.Web.WebView2.Wpf.WebView2 control. This control is heavily restricted to prevent abuse.
Sources: PeP.ExamApp/Pages/ExamRunnerPage.xaml.cs:175-230
// PeP.ExamApp/Pages/ExamRunnerPage.xaml.cs:178-185
private static void HardenWebView2(Uri serverBaseUri, CoreWebView2 core)
{
var settings = core.Settings;
settings.AreDevToolsEnabled = false;
settings.AreDefaultContextMenusEnabled = false;
settings.AreBrowserAcceleratorKeysEnabled = false;
settings.IsStatusBarEnabled = false;
settings.IsZoomControlEnabled = false;
// ... and more
Key restrictions include:
- Developer tools are disabled.
- Context menus and browser accelerator keys are disabled.
- Pop-ups and new windows are blocked.
- File downloads are blocked.
- Navigation is restricted to the originating server's domain.
- Permissions for clipboard, camera, and microphone are denied.
Sources: PeP.ExamApp/Pages/ExamRunnerPage.xaml.cs:178-200
Digital Watermarking
To discourage screenshots and screen sharing, a dynamic watermark is rendered over the entire exam window. The watermark contains the student's email, the current attempt ID, the machine name, and a timestamp.
Sources: PeP.ExamApp/Pages/ExamRunnerPage.xaml.cs:232-273
Data Models for Authorization
The authorization and session management process relies on several key tables in the database to track tokens and attempts.
This ER diagram shows the relationships between users, exams, and the authorization/session entities.
ExamAppAuthorization: Stores a short-lived (15 minutes) authorization token generated after a teacher provides their password. This token proves that the session was approved. It is a one-time use token.ExamAppLaunchSession: Stores a longer-lived token tied directly to anExamAttemptorProgrammingExamAttempt. This token is passed in the URL to the web application to load the exam and is validated by the server to ensure the session is active and legitimate.
Sources: Services/ExamAppService.cs:166-175, 281-294
Conclusion
The Student Exam Workflow in PeP5 is a comprehensive system that layers multiple security and authorization measures to create a trusted environment for online examinations. By combining a locked-down desktop client, a multi-step authorization flow with teacher involvement, and a hardened in-app browser, the system effectively mitigates common cheating vectors. The separation of authorization and launch tokens, managed through the ExamAppService and tracked in the database, provides a robust and auditable trail for each exam session.