AnsweredAssumed Answered

LTI Content Wrapper

Question asked by alex@hifyre.com on Sep 26, 2018

Hello,

 

We have an LTI integration that works in a staging environment running Release 3300.0.4-rel.65+9afd532. In production, we’re running Release 3300.0.3-rel.41+a9e64de, but the identical setup in staging, won’t work in production.

 

We’ve built an LTI integration that takes us to an external application. In production, we get the following error:

 

Refused to display 'https://tact.confederationcollege.ca/?token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1aWQiOiJnNTBmYkE2cnd3V0Z1TjlQR3FEcmhNQ2gyMzhjaW0tanNoZWlIek54bzF3IiwidXNlcklkIjo0LCJpYXQiOjE1Mzc5MTk2NjV9.s-7R6sdgnQsvqJv91NE_vaaIK2HqiAJjelc-ZwTNA7KkllrcfM5ufsU91vqNHZk9xh6XULzrAkTaSAfJsk7G2PY6qLZHWPWR2s6pM_h7GbgsqzSwVi6xtNEVt7WjfCjZxOQhy3Mpv-DQ8DScc_-GyLihKEIOvc-AFID0v1kAvE4QEdlD8yg1Qp0y3sem4gJcpEvrLOxC5wyOPiYzVGJ2DOLuundsVE4HIYLVjK7m0p13fHcJ5WqQTw3p5_eaOg0icGGHLiyBl89o8cEDL24pZYpbZZx2V-A5ylujPH_vQAwFQB6ts_10cxCB55CvzkGAPWhZqUSQnmABn6xR5Z35jb2-Au_SAzs8EnRX6YNWxFdwNPU1AamWVeEMuEcR6mp7tu_uuBadLh20iHChTfzNAmSAYAvnJuGpY6-INnSIQJNWMMVtW1LfajZ_baWwB52dzATc0PWSzn1Q1yMB2ORlWHdm9b5TMpo5XWjvHObYYxdO3yF1H2qSCt9CBifAI9uvHidoQySy_FB0cNiLaW0mjM-xgUXbIqPF619Fb574kAuUy2sdK8gxUrPrWrSU3S2xR8-7sDI0L0YfSNUHMvQP7NQK7wjoiylgE2wYTc0url3ZEaciDQGUNRdeLgB2i7-lEmdzmR4fUV1c1WvAG1qSJUGO6YhuLMRYV2MZJNhqPXc' in a frame because it set 'X-Frame-Options' to 'sameorigin’.

 

We had a fix deployed in staging that fixed the cross origins issue we see in this error, but the same fix just won’t work in the production environment. So we’re not sure if this error is in fact the issue, or just a by product of something else.

 

When we look at the URL itself, we’re noticing a contentwrapper.jsp being applied in production, which seems to be preventing the LTI from opening, and what we suspect is triggering the cross origins. You can see for example:

 

This URL structure works fine, when we strip the contentwrapper from it:

 

https://confederation.blackboard.com/webapps/blackboard/execute/blti/launchPlacement?blti_placement_id=_88_1&course_id=_63835_1&mode=view&wrapped=true&globalNavigation=false

 

But, Blackboard seems to be applying it by default, or it’s a setting somewhere that we can’t figure out, that turns the URL to:

 

https://confederation.blackboard.com/webapps/blackboard/content/contentWrapper.jsp?course_id=_63835_1&displayName=TACT+Integration+for+IGPA+Program&href=%2Fwebapps%2Fblackboard%2Fexecute%2Fblti%2FlaunchPlacement%3Fblti_placement_id%3D_88_1%26course_id%3D_63835_1%26mode%3Dview%26wrapped%3Dtrue

 

So we’re wondering if there is some global setting that’s turning on this contentwrapper, or if we’re missing something in the LTI config itself…

Outcomes