canvas_lti_third_party_cookies 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4aee3fcacd57feaf3915e824211dce8afde5350cc286b5fb728cb37c9b92836f
-  data.tar.gz: 21383e419b634141097ca3c593e3cd885c50b1271d124ea16fe075b1479486c9
+  metadata.gz: 890865e3f76d11ffcb3c1e203b7b507c068127b0b2cba1455fdf0fa558ef96f8
+  data.tar.gz: 197439ea71f9dd99b21235358022f7c324f86fdec4e03ce93c7f28201dfc2d83
 SHA512:
-  metadata.gz: 2dcf8ce2b2ae43d7e94e5f1a105bc93a9aa2a11bd374f2eb82516f4c029a6a3329cc6950eef9a59f1bcdc3e7be7b6f8b5571b26c83798e20121d9c67f38c9aa2
-  data.tar.gz: e87c29658574fe2f3a3cfa4e0006ce0bd05860d28b4c7731306a0b2f8c4fceffbd4d319859c4795b3e433721fcf943331374b8816481b9ed8f2045b6ce9a5bdc
+  metadata.gz: 8c7001cbfb01825b8a475ed48f15cfdd3e962ce5fcda789f1a211a1445c5d75e8f171982a7e7c4ed954e43a22f393f781be9a9e15fbfee97122e7f8438cac9d6
+  data.tar.gz: 8a4a17fc88a70d26b57ea6862bdbd9f71bd2ec21cfa548e42868d4dec3167be6d24471c29ed346e03dfa8900ff6b4e08849084519160ce8f78f5a8a927bd59b5

data/README.md

@@ -32,6 +32,16 @@ before_action -> {
 }
 ```
 
+This will launch the tool multiple times, and also redirect the user back to Canvas when needed. For more information on the detailed tool
+launches, see the comments in `app/controllers/concerns/canvas_lti_third_party_cookies/safari_launch.rb`.
+
+Note that the tool will be relaunched from within this method once Storage Access is granted and pass all parameters from the previous
+Canvas launch, which will break JWT nonce verification since it will detect the nonce has already been used. 
+
+To combat this, this gem provides the `should_ignore_nonce?` method so that your tool can ignore the nonce verification for that
+specific launch. Normally, ignoring a duplicate nonce can lead to replay attacks. This method will only return true if the request's
+`Referer` header matches the tool's domain, which only happens in this last internal redirect.
+
 ## Installation
 Add this line to your application's Gemfile:
 
@@ -49,4 +59,12 @@ $ bundle install
 
 ```bash
 $ rails test
-```
+```
+
+## Publishing New Versions
+
+1. Bump the version in `lib/canvas_lti_third_party_cookies/version.rb`.
+2. Commit, push, and merge that change.
+3. `rake install`
+4. `gem push pkg/canvas_lti_third_party_cookies-<version>.gem`
+  - note that this will only work if you have access

data/app/controllers/concerns/canvas_lti_third_party_cookies/safari_launch.rb

@@ -23,13 +23,9 @@ module CanvasLtiThirdPartyCookies::SafariLaunch
     return unless browser.safari? || (browser.webkit? && browser.platform.ios?)
 
     # Safari launch #4: Storage Access has been granted,
-    #   so launch the app normally.
-    if params[:storage_access_status].present?
-      # remove from request directly instead of only from `params` so that
-      # the tool *really* doesn't have to worry about this being present
-      request.request_parameters.delete(:storage_access_status)
-      return
-    end
+    #   so launch the app normally. Note that this is not an actual LTI launch, but
+    #   just opaquely passing on the data from launch #3.
+    return if params[:storage_access_status].present?
 
     # Safari launch #2: Full-window launch, solely for first-party user interaction.
     #   During a full-window launch, Canvas provides a :platform_redirect_url that
@@ -57,6 +53,15 @@ module CanvasLtiThirdPartyCookies::SafariLaunch
     )
   end
 
+  # Safari launch #4 (described above) is actually an internal opaque redirect of launch #3
+  # and not a real Canvas LTI launch, so the id_token (and specifically the nonce inside)
+  # is exactly the same. Normally, ignoring the nonce is a Bad Idea since it can allow
+  # replay attacks, but for this specific situation (the request is an internal redirect)
+  # it's a sufficient hack.
+  def should_ignore_nonce?
+    params[:storage_access_status] == "granted" && URI.parse(request.referer).host == request.host
+  end
+
   private
 
   def relaunch_url(launch_url, launch_params)

data/lib/canvas_lti_third_party_cookies/version.rb

@@ -1,3 +1,3 @@
 module CanvasLtiThirdPartyCookies
-  VERSION = '0.3.0'
+  VERSION = '0.3.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: canvas_lti_third_party_cookies
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Xander Moffatt
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-03-01 00:00:00.000000000 Z
+date: 2021-03-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails