Uploaded image for project: 'Sakai'
  1. Sakai
  2. SAK-34032

Adjust ContentItem Implementation to Work with SameSite strict

    XMLWordPrintable

    Details

    • Type: Task
    • Status: RESOLVED
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 12.2, 19.0
    • Component/s: None
    • Labels:
    • 12 status:
      Resolved
    • 11 status:
      Please Merge
    • Test Plan:
      Hide

      Without this patch, ContentItem (App Store) selections will fail. 

      If you add this patch and set this parameter, ContentItem will start working.

      session.parameter.allow=true

      Show
      Without this patch, ContentItem (App Store) selections will fail.  If you add this patch and set this parameter, ContentItem will start working. session.parameter.allow=true

      Description

      In ---KNL-1584--- we implemented SameSite cookie which broke all ContentItem Callbacks whether it is strict or lax.   This JIRA will make it so that ContentItem works when SameSite cookie is set.  I Investigated several solutions:

      • I initially thought that I could move the code that responds to the POST from the LTI Admin tool to a servlet - but since the POST is coming from the browser - this is not a solution.
      • My next investigation is setting SameSite to LAX when I launch the external tool and setting it back to strict when I return from the launch

      Here is an option that at this point I am discarding for the moment - I include this so you understand its flaws 

      • Teach Tsugi to do the POST server to server, receive the redirect and then go to the redirect.  This is bad for several reasons (1) non-Tsugi ContentItem sources will fail unless they take this approach and (2) Not every LMS sends a redirect after it gets the POST - at one point Canvas handled this response in the browser and there was no redirect.  So it is not likely that a Tsugi server-to-server approach could be made to work reliably for all LMSs.

      Please comment below as I work through the various options.

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  csev Charles Severance
                  Reporter:
                  csev Charles Severance
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  8 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved:

                    Git Source Code