[ARCHIVED] How can I display an alert if student is on certain IP address?

[dkpatton]

My campus has a guest network that students are not supposed to use. Unfortunately, about 10-20% of our students use guest. This has not been a problem until recently when students have used LockDown Browser to take Canvas quizzes. The high latency causes the application to fail. 

In considering solutions, we had an idea that would be very tidy. Using custom code in our sub-account course theme, it should be possible to grab the user's IP address and insert an element on the page that warns them about using the guest network. We could then monitor last-login IP addresses until we are confident that students have configured the secure enterprise network. Then we can disable the function in the template.

I think the solution is going to use our sub-account custom course theme JS. All solutions I've explored so far have used a third-party tool to retrieve the IP address, which would probably fail due to cross-site scripting controls. However, since IP filtering is an option in Quizzes, my hope is that I could read the IP address easily from the session cookies or some other object. However, I can't seem to locate the IP if it indeed stored in an accessible location.

Can my Canvas template get the user's IP address without causing cross-site scripting errors?

---

Updated: Clarification and Precision.

[kona]

Due to the nature of this question, I'm going to share it with the https://community.canvaslms.com/groups/canvas-developers?sr=search&searchId=473d3661-11f6-4aeb-a7e5-...‌ to see if they can help!

[ben_hudson]

Hi David,

So let me make sure I'm understanding this correctly, you want to grab and verify IP addresses from your guest network to see who is a student or not and then send them a message and instructions explaining that they need to get off the guest network because it is not powerful enough to handle the LockDown Browser?

Are you hoping there is a way you can do this in Canvas?

[dkpatton]

Hi Ben,

Thanks for following up. These are great questions that help focus the question. I am not expecting to use an off-the-shelf tool in Canvas. I think it has to be custom code on our stub-account.

So let me make sure I'm understanding this correctly, you want to grab and verify IP addresses from your guest network to see who is a student or not and then send them a message and instructions explaining that they need to get off the guest network because it is not powerful enough to handle the LockDown Browser? Are you hoping there is a way you can do this in Canvas?

Basically, yes. However, I was not considering using a built-in tool to send the message (e.g. global announcements, inbox, announcements). Instead, I assumed that I would be displaying an alert on the home page of courses if the user was on the guest network.

-Dave

[ben_hudson]

Dave,

I think i'm following now, sounds to me like you're wanting this to be real time. So I'd say some Javascripting and custom css might be able to accomplish what you want...don't hold me to that, just the path I would look towards first. These are both out of my scope of knowledge, maybe someone here can help you though.

Good Luck!

Ben

[akkaufmann]

Hi  @dkpatton ‌,

I believe that you could make a GET request to /api/v1/users/self/page_views via Javascript and then get the IP address (remote_ip) from the first PageView object returned (the entries are in chronological order starting with the most recent).

Because the user is already logged into Canvas when this script runs, you don't need to worry about an access token or authentication.

Alex

[akkaufmann · Accepted solution]

Hi  @dkpatton ‌

I did a quick test, and it seems that my theory was correct.

Here is the script I used for testing:

$.getJSON( "/api/v1/users/self/page_views", function( data ){
      alert(data[0].remote_ip);
   }
);

This only displays the user's IP address in the alert box, but it should give you a base for your code.

I will also note that this is using jQuery, but since Canvas is dependent on jQuery, you shouldn't need to load any additional libraries.

Alex

[dkpatton]

THANK YOU!! This is exactly what I needed. I did not know that students could interact with the API. Man, I love Canvas.

[dkpatton]

I got this code working on my page properly. Interestingly, I will occasionally get an AWS address and not my own address. Any idea why this could be the case?

User runs this function shortly after landing on the home page of the site:

function getIpAddress () {
   $.getJSON( "/api/v1/users/self/page_views", function( data ){
      var myIpAddress = data[0].remote_ip.toString();
      $.cookie("my_ip_address", myIpAddress, {path: '/'});
         }
      );
}

[akkaufmann]

This is most likely the actual API call from your script be adding to the user's page view records.

This will probably need a little more research, but I think a way to verify if the page view is an API or not is to check if the 'user_agent' is NULL or the 'action' or 'URL' contains API in the string.

For example:

function getIpAddress () {
   $.getJSON( "/api/v1/users/self/page_views", function( data ){

         foreach(i = 0; i < data.length; i++){

            if(data[i].user_agent != NULL){
               var myIpAddress = data[i].remote_ip.toString();
               $.cookie("my_ip_address", myIpAddress, {path: '/'});

               return;

            }
      }
   );
}

[dkpatton]

Great suggestion! This may come in handy.

However, I realized that I the root of the problem is that I delayed the request by placing it beneath some other code that only ran if a user stayed on the page for longer than 4 seconds. Therefore, the cookie was set at an inappropriate time.

If this becomes a permanent feature of our sub-account, I think I would want to build in some validation like in your example. 

Since this is a temporary stop-gap, and I'm more concerned about false positives than false negatives.

My problem is solved! Thanks, Alex! You rock!!

[bdalton_sales]

Can i suggest that take a step back and block them from loggin in while on that network rather than trying to js it in canvas.  Most auth systems (adfs, cas, shib) you can set up a clain that is only allowed from some ips to prevent them from using that network.  It would also push them to use the correct one.

[dkpatton]

I think that's a great suggestion. Unfortunately, that would affect everyone on our campus, of which our school is only a small percentage. Controls within the Canvas sub-account offers a more focused approach for our student population.

[tgroot]

Our solution is to block Canvas on the Guest network at the firewall.  Simple and effective at keeping the students off Guest, and it doesn't affect non-Canvas users on Guest.