LTI 1.3 launch => iframe cannot get log_session_id cookie

[TinaWong]

Hi all, 

(I use sandbox with AWS Canvas Subscripiton.)

Our tool requires user authorization for using Calendar API. However, users would be redirectd to Canvas login page when asking for permissions with authorization code path in iframe. It works perfectly when opening in a new tab, though. I wonder how I could run auth redirecting smoothly in iframe.

Could someone please give me some directions so that I could know where to work on?

Many thanks,

Tina

[matthew_buckett · Accepted solution]

There are problems with LTI tools running in iframes getting their cookies blocked, but I haven't seen problems with the actual Canvas cookies being blocked. This isn't something like using a different domain for the OAuth2 flow and so you're not logged in there? Is the browser sending the Canvas session cookie on the request in the iframe?

We normally launch the OAuth2 flow to ask the user for access in a new browser tab and then use a window.postMessage to tell the LTI tool that the token has been granted, but if I change this to be in the iframe it still seems to work ok.

[TinaWong]

Thank you so much for replying!
I just figured out that I shouldn't redirect to a totally new domain and then redirect to login auth URL. That causes cookies being blocked for sure...... 

Now I redirect to login auth URL first and everything is fine!

Many thanks,

Tina

[matthew_buckett]

Glad you got it sorted. One other thing to watch out for is that sub-domains are also treated differently by browsers. So we have a vanity domain for our Canvas instance eg, https://canvas.inst.ac.uk and we then deploy our production tools onto sub-domains eg https://courses.canvas.inst.ac.uk/ and these worked ok.

However if you accessed the tools through the standard Instructure URLs (https://inst.instructure.com) or through the beta/test instances which don't have vanity domains things started getting blocked.