Uploaded image for project: 'Moodle'
  1. Moodle
  2. MDL-83538

LTI Token endpoint fails to set Content-type header, resulting in fallback to text/html

XMLWordPrintable

    • MOODLE_404_STABLE, MOODLE_405_STABLE, MOODLE_500_STABLE
    • MDL-83538-404
    • MDL-83538-405
    • MDL-83538-main
    • Hide

      There's no easy way to test this, given we need a working LTI setup to call the token endpoint with a signed JWT to get a token.

      I think the best way is likely to just set up Moodle-to-Moodle, grade an assignment and run sync_grades (which, as part of the sync, will request a token). If we add a breakpoint in the tool code at the right point, we can confirm the response header is set properly.

      Prerequisites:

      1. Working Moodle-to-Moodle LTI setup (see docs https://docs.moodle.org/en/Publish_as_LTI_tool). Assume one site is called 'platform' and one 'tool'.
      2. In the tool site, publish an assignment using LTI 1.3
      3. In the platform site, go to a course.
      4. Add an instance of the tool, via activity chooser, pick the assignment via 'Select content'.
      5. Log in to the platform as a student.
      6. Launch the assignment and submit something
      7. Log in to the platform as the admin again
      8. Launch the assignment and click "View all submissions"
      9. Enable quick grading (checkbox), and grade the student who submitted their work.
      10. Add a breakpoint in the tool code here: https://github.com/moodle/moodle/blob/63569a4776327f18a4edcf2e27effcedbd758420/lib/lti1p3/src/LtiServiceConnector.php#L76
      11. Now, in a terminal, cd to the root of the tool site
      12. Run the following: 

        php admin/cli/scheduled_task.php --execute="\enrol_lti\local\ltiadvantage\task\sync_grades"

      13. That will schedule the adhoc tasks. Now run: 

        php admin/cli/adhoc_task.php --execute

      14. When the grade sync is attempted, you should see your breakpoint is hit.
      15. Inspect the value of $response at that point in code and verify:
        • There is a content-type header
        • The content-type header is set to "application/json; charset=utf-8;"
      Show
      There's no easy way to test this, given we need a working LTI setup to call the token endpoint with a signed JWT to get a token. I think the best way is likely to just set up Moodle-to-Moodle, grade an assignment and run sync_grades (which, as part of the sync, will request a token). If we add a breakpoint in the tool code at the right point, we can confirm the response header is set properly. Prerequisites: Working Moodle-to-Moodle LTI setup (see docs https://docs.moodle.org/en/Publish_as_LTI_tool) . Assume one site is called 'platform' and one 'tool'. In the tool site, publish an assignment using LTI 1.3 In the platform site, go to a course. Add an instance of the tool, via activity chooser, pick the assignment via 'Select content'. Log in to the platform as a student. Launch the assignment and submit something Log in to the platform as the admin again Launch the assignment and click "View all submissions" Enable quick grading (checkbox), and grade the student who submitted their work. Add a breakpoint in the tool code here: https://github.com/moodle/moodle/blob/63569a4776327f18a4edcf2e27effcedbd758420/lib/lti1p3/src/LtiServiceConnector.php#L76 Now, in a terminal, cd to the root of the tool site Run the following: php admin/cli/scheduled_task.php --execute= "\enrol_lti\local\ltiadvantage\task\sync_grades" That will schedule the adhoc tasks. Now run: php admin/cli/adhoc_task.php --execute When the grade sync is attempted, you should see your breakpoint is hit. Inspect the value of $response at that point in code and verify: There is a content-type header The content-type header is set to "application/json; charset=utf-8;"
    • Hide

      Code verified against automated checks.

      Checked MDL-83538 using repository: https://github.com/snake/moodle

      More information about this report

      Built on: Thu 24 Oct 2024 02:59:56 AM UTC

      Show
      Code verified against automated checks. Checked MDL-83538 using repository: https://github.com/snake/moodle MOODLE_404_STABLE (0 errors / 0 warnings) [branch: MDL-83538-404 | CI Job ] MOODLE_405_STABLE (0 errors / 0 warnings) [branch: MDL-83538-405 | CI Job ] main (0 errors / 0 warnings) [branch: MDL-83538-main | CI Job ] More information about this report Built on: Thu 24 Oct 2024 02:59:56 AM UTC
    • 1

      Kindly reported by Tom in his forum post here: https://moodle.org/mod/forum/discuss.php?d=463150

      By not actively setting the content-type header in the token endpoint, we're leaving the header set by the lib/setup.php script (see https://github.com/moodle/moodle/blob/aa543e8c3985d22e0f3ff4e2a207e2e63a83b2ff/lib/setup.php#L953). That's obviously not what we want here, given the return is application/json. The relevant section of the IMS Security Framework is 4.1.1.1 Using a JWT as an Access Token. This hasn't caused major issues (or even any reports that I know of), but I can see how that might be a problem if the client code was being strict with content type parsing.

      Should be a trivial, one liner fix.

            jaked Jake Dallimore
            jaked Jake Dallimore
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:

                Error rendering 'clockify-timesheets-time-tracking-reports:timer-sidebar'. Please contact your Jira administrators.