macOS 3.7: "Starting an exam" config won't launch the exam — reconfigures/restarts on file open, locks up and returns to portal on seb:// link

[menziesrm]

Describe the bug

On macOS (SEB 3.7), a .seb configuration file whose purpose is "starting an exam" (sebConfigPurpose = 0) fails to start the exam session, via two different launch paths:

Double-clicking the .seb file: SEB processes it through the client-reconfiguration path (reconfigureClientWithSebClientSettingsCallback) and immediately quits to restart (sessionQuitRestart restart: 1). After the restart SEB does not enter Assessment/kiosk mode — the normal desktop and other apps stay visible, only the SEB menu-bar title appears, a "Location Services Required for Wi-Fi" prompt shows, and the start URL never loads. Every attempt produces an identical ~20-line log ending at the restart trigger.
Launching via seb:// link from the exam portal: the same config fails to start the exam — SEB locks up and returns to the same portal page instead of entering the exam session.

Launching SEB directly from the Applications folder (using already-stored client settings) works correctly and loads the exam portal in full lockdown. The failure occurs only when launching via the config file or the seb:// link.

To Reproduce

Path A — config file:

On a Mac with SEB freshly set up, double-click the "starting an exam" .seb file.
SEB shows the "SEB Re-Configured" dialog and quits to restart.
SEB relaunches but does not enter Assessment/kiosk mode — normal desktop and apps remain visible, a "Location Services Required for Wi-Fi" prompt appears, and the start URL is not shown.
Re-clicking the config file repeats the same reconfigure-and-restart with no exam session (reproduced 8× in the logs).

Path B — seb:// link:

From the exam portal, click the seb:// link that launches the same 3.7 exam config.
SEB locks up and returns to the same portal page instead of starting the exam session.

Expected behavior

Both launch paths should apply the settings and start the exam session — entering Assessment/kiosk mode and loading the configured start URL (https://e-exams.sace.sa.edu.au/...), the same locked-down state that a direct launch of SEB from the Applications folder produces.

Screenshots

The "Location Services Required for Wi-Fi" prompt shown after the file-open launch (SEB running but not locked down, with the normal desktop visible behind it).

Version Information

OS: macOS [macOS 26.2 and 26.6]
SEB Version: [SEB 3.7 build 1591F]

org.safeexambrowser.SafeExamBrowser 2026-08-11--02-42-42-110.log
org.safeexambrowser.SafeExamBrowser 2026-08-11--02-40-18-792.log

Additional Context

Reproducible on every config-file launch and every seb:// launch on this machine; direct launch of SEB from /Applications works, so the app install and permissions are functional.
Config settings: sebConfigPurpose = 0 (starting an exam), lockdownModePolicy = 0 (Automatic, so AAC is selected on supported macOS), allowWlan = true (source of the Location Services prompt), aacDnsPrePinning = false, minMacOSVersion = 0. Authored with originatorVersion = SEB_iOS_3.7_1591F.
The file-open path is logged as being processed via reconfigureClientWithSebClientSettingsCallback with a pwcc outer prefix, even though the config's purpose is "starting an exam" (0). Worth confirming whether a purpose-0 file should ever take the client-reconfiguration path.
Possibly related to the 3.7 release-note item: "When reconfiguring from SEB settings which have AAC active … some system alerts were hidden. This mostly applied to the macOS Screen Recording and Accessibility permissions dialogues. SEB was then stuck…" — the reconfigure → restart → no-lockdown sequence here resembles that path.
Granting Full Disk Access + Location Services and rebooting did not change the behaviour.
For Path B, confirm the exact scheme used by the portal link (seb:// vs sebs://), as it affects how SEB fetches the config.
Logs available from ~/Library/Logs/Safe Exam Browser/ (8 file-open sessions; a log from a seb:// attempt should be captured separately as its path differs). A password-scrubbed copy of the config can be provided. A SACE demo/test login may be needed to fully reproduce the post-lockdown page load — advise if required.

[danschlet]

Can't reproduce this. When the log says,
2026/08/11 12:42:42:203 Outer prefix of .seb settings file: pwcc
SEB will be reconfigured, because your configuration file was saved with "configuring client". You said you created it with SEB for iOS? Then there's maybe a bug.

The setting sebConfigPurpose is mostly used for the settings UI in Settings / Configuration / "Use Configuration For ...". It usually doesn't determine if a config is for starting an exam or configuring a client, the header of the configuration file has always the higher priority to determine that.

[menziesrm]

@danschlet , is there somewhere secure I can send you a config file that isnt public? I am using a config file that I have generated on my macbook pro not ios. and its 100% set to starting an exam.

[menziesrm]

@danschlet I've also just tested this with vanilla SEB 3.7.
Steps taken:
launched SEB for Mac 3.7, changed the Start URL, saved the configuration as "start exam" type, then closed the app. When I double-click the config file to launch, SEB opens but only displays the macOS application menu bar (File, Edit, etc. in the top left) — nothing else appears

[danschlet]

You can send the file to info at safeexambrowser. org

[danschlet]

@danschlet I've also just tested this with vanilla SEB 3.7. Steps taken: launched SEB for Mac 3.7, changed the Start URL, saved the configuration as "start exam" type, then closed the app. When I double-click the config file to launch, SEB opens but only displays the macOS application menu bar (File, Edit, etc. in the top left) — nothing else appears

Also can't reproduce that. I start SEB using default settings (or use Revert to Defaults), change Start URL, save the configuration "for starting exam", close SEB. Double click the config file, SEB starts correctly.

[danschlet]

I tested opening both the configuration files you sent me, with the original SEB 3.7 in a fresh condition (like a fresh install, removed preferences plist, PW item, reset system permissions with "tccutil reset All org.safeexambrowser.SafeExamBrowser" and reset Location Services authorization by running another a debug build with another signature (as it seems the location permissions cannot be reset in macOS). Still SEB is starting perfectly and with "starting an exam", doesn't apply configuration to client.

I assume your log files were generated by your custom build and something is different there than in the original SEB. As long as I can't reproduce the issue in an original SEB, I consider this not a bug in SEB. And again, consulting for custom builds of SEB requires an SEB Alliance membership, see https://safeexambrowser.org/alliance/fees.html.

[menziesrm]

Some new findings that should make this reproducible.

The key precondition: our deployment applies a configure-client config (Outer prefix: pwcc) at every SEB launch, which triggers a reconfigure + session restart on startup. A default SEB install doesn't do this — which I suspect is why it can't be reproduced.

What happens: when a "starting an exam" .seb file is double-clicked, its open event arrives during that startup window and is deferred:

18:31:23:171  -[SEBController application:openFile:] file URL: .../startingexam2.seb
18:31:23:180  Delay opening file ... while starting up.
18:31:23:713  ---------- RESTARTING SEB SESSION -------------   <- from the client reconfigure
18:31:23:725  OpeningSettings = true, abort -[SEBController conditionallyInitSEBWithCallback:selector:]

The restart discards the deferred file open but never clears the openingSettings flag, so the new session aborts init and SEB hangs — no lockdown, no browser window, no error. The exam config is never parsed at all (no Outer prefix line for it). Reproduced 6/6 today with two different exam configs.

Proof the config is fine: from the hung state, opening Settings, loading the same file there, and Apply & Restart works perfectly — the file parses, AAC starts, and the exam session loads. Startup resumes via the "Preferences window was opened while starting up SEB, continue now to start up" path, which confirms the hang is just the stale openingSettings flag.

To reproduce: deploy a configure-client config so SEB reconfigures + restarts at every launch, then with SEB quit, double-click any purpose-0 exam config.

Logs attached (failing sessions + the working Settings recovery). Scrubbed copies of both configs available on request. Happy to test a beta build.

org_safeexambrowser_SafeExamBrowser_2026-08-19--08-30-01-737.log

[danschlet]

How do you "deploy a configure-client config"? The supported way is to have a SEBClientSettings.seb file in Library/Preferences/ (either for current or all users on the Mac).

[menziesrm]

Hi Dan, Correct it sits in Library/Preferences

[danschlet]

Ok, now I can reproduce it, I 'm working on it. Thanks for reporting it!

[danschlet]

This should be fixed in SEB 3.7.1b2. Please confirm if it works for you now.