Question for anyone using Django to serve LTI apps for edx.org courses, and thereby using the LTI xblock : have you seen the notice in Chrome about cookies and the SameSite header? If you have the Chrome dev console open when you load an edx.org page that contains an LTI xblock pulling in an exter…

FYI @DanielMcQ @Zachary_Trabookis edX have merged our PR to master, so this fix will be available in Juniper: edx-platform#23671 . :tada:! @DanielMcQ if this resolves the issue you raised, could you mark this post Solved?

Thanks for posting this @DanielMcQ ! Am also concerned about this issue for our clients that use Cross-domain CSRF cookies … I assume Django will backport this to 1.11 since it’s still supported? But we’ll need to upgrade the minor version at least, and get that into ironwood.

Oh… could this be the cause of my problem with LTI while testing Juniper? And also why it does not work anymore on a recent single server instance of Ironwood I just installed? I remember seeing your post @DanielMcQ a few weeks / months back. I have a lead to investigate further what is going on…

I found my problem. It wasn’t related to that. An ALB/ELB/AWS/SSL/NGINX combination was the culprit. Changes I made in our production systems and test systems but not on our single server systems using only the vanilla open-release/ironwood.master and open-release/juniper.alpha1.

@DanielMcQ I ran into this issue and posted here. https://openedx.slack.com/archives/C0GR05YC9/p1585674197001400 This SameSite cookie is effecting LTI Consumer content from rendering in an external LMSs (e.g. Canvas, Blackboard) from pulling in LTI content from our Open edX instance (LTI Provider)…

@DanielMcQ I seemed to get LTI Consumer through Canvas pulling content from our Open edX Provider by doing the following. I haven’t received any error about not being logged into my edX account from Canvas and the SESSION_COOKIE_NAME doesn’t display the message since Secure=True and SameSite=None f…

Thanks for posting this @Zachary_Trabookis ! I followed these steps on my Juniper sandbox which is an LTI provider. (Note: had to modify lms.envs.production to add the additional settings instead of lms.envs.private, since it’s not a devstack.) EDIT Please disregard the notes below. These issues …

@jill We’re using anonymous authentication with LTI Provider. I couldn’t figure out edX authentication with LTI. I added the middleware at the end of the list then moved it to the beginning. Restarted edX services and then it started working from Canvas. We’re also not using Site Configuration to s…

@jill @DanielMcQ Here is a fix for LTI Provider calls for the SameSite cookie issue for the Hawthorn. I’m sure this could be applied similarly for releases after this release. Let me know if you see anything wrong. Fix `SameSite` cookie issue for LTI Provider …

LTI XBlock and SameSite

Development

Zachary_Trabookis (Zachary Trabookis) April 3, 2020, 2:44am 9

@jill Do you think the cookies get set everytime you make an LTI provider request? Wonder if you should try a private browser or clear cookies for your Juniper Open EdX site before making another request.

Topic		Replies	Views
Can't login to admin panel with Chrome (but it works with Firefox) Site Operations Help juniper	1	1164	August 31, 2020
JUNIPER.MASTER - Fresh Install: Forbidden (CSRF cookie not set.): /change_enrollment Site Operations Help	11	3709	September 3, 2020
"activate_block_id" cookie samesite Site Operations Help	1	544	April 17, 2020
Cannot access LTI Deep Link response in openedx Development api , how-to , devstack , tutor , lti	0	98	June 20, 2024
Please some help loging-in! Site Operations Help	11	2862	December 26, 2020

LTI XBlock and SameSite

Related topics