[Saaweel]

An LTI 1.3 object with the launch option "Embedded Content" often shows the ILIAS page itself inside the iframe, or "initialLogin Error", instead of the content of the tool. It happens whenever another request of the same session runs while the launch goes on, for example the asynchronous requests of the tree in the main bar, opening the object from "Last Visited", or the same object in two tabs. The slower the server, the more often it happens.

The launch keeps its state in the session: the page that starts the launch stores lti_message_hint, and ltiauth.php stores the authentication request of the tool as lti13_login_data before it redirects to the object. ILIAS writes the whole session back at the end of every request, so a parallel request that read the session earlier writes it back without these values and the launch cannot find them anymore.

Fix

• The lti_message_hint of a launch is the object and the ILIAS client, signed with an HMAC for the session and the user. The tool sends it back unchanged, so the launch is checked without anything in the session.
• ltiauth.php passes the authentication request of a launch to the object with the link it redirects to, instead of the session. The launch checks it as before and also checks the read permission of the user.
• Content selection keeps working as before.

Testing

On test installations, with bwGPT, an ILIAS installation as tool and saLTIre:

• Embedded launch with the tree of the main bar open: it failed in most launches before the change and works in every launch after it. Also from "Last Visited" and with the object open in two tabs at the same time.
• Launch options "New Window" and "Same Window", including the return link of the tool.
• A launch with a forged message hint is refused with "initialLogin Error".

A launch page that was opened before the update carries a hint without signature, so its launch fails once; it works again after reloading the page.