ylqjgm
/
canvas-lms
mirror of https://github.com/instructure/canvas-lms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
canvas-lms/app/views/plugins
History
Jacob Fugal f71f1aa81d safari inst-fs service worker 
closes SAS-1474, SAS-1452

canvas server-side, when:
  * a canvas request would generate a redirect to an inst-fs file
  * but the request also includes a `X-Canvas-File-Location` header
  * and the request is session authenticated

then the server instead responds with a JSON object with:
  * a `location` field containing the nominal redirect target
  * a `token` field containing a token that can be used as a value for
    an `Authorization: Bearer <token>` header when requesting the file

a service worker is then added that intercepts non-navigation GET
requests to those endpoints. it adds the X-Canvas-File-Location header
to the request, and then issues a followup request for the returned
location with the Authorization header added. in effect, it's following
the redirect but with the Authorization header injected. inst-fs can
then recognize the Authorization header as a means of user
authentication in the absence of cookies.

finally, the service worker is installed only if:
  * the plugin setting controlling it is enabled
  * the browser is Safari 13+

other browsers are able to use simpler work arounds when cookie blocking
is enabled and can thus take advantage otherwise.

test-plan:
 * have canvas and inst-fs both served over https
 * for safari, be using 13.1 or newer with tracking prevention enabled
 * leave the service worker disabled through the inst-fs plugin setting
 * have an image uploaded to inst-fs
 * visit the image's preview page in the files UI:
   - in safari: observe the image fails to load
   - in chrome: observe the image successfully loads
 * enable the service worker via the plugin setting
 * refresh the image's preview page:
   - in safari: observe the image now successfully loads
   - in chrome: the image still successfully loads, but does so without
     involving the service worker

Change-Id: Ie28f2cad40f67549bfbb4c7c6604f215581fbe18
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/237135
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
 		2020-07-02 22:39:11 +00:00
..
_account_report_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_app_center_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_apple_settings.html.erb add Sign in with Apple 2020-06-03 16:07:58 +00:00
_assignment_freezer_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_big_blue_button_fallback_settings.html.erb only use BBB fallback if explicitly configured, refs BBB-40 2020-04-27 16:27:53 +00:00
_big_blue_button_settings.html.erb only use BBB fallback if explicitly configured, refs BBB-40 2020-04-27 16:27:53 +00:00
_byots_docs.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_canvadocs_settings.html.erb Canvadocs hijack crocodoc sessions 2017-05-03 22:11:01 +00:00
_clever_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_crocodoc_settings.html.erb allow disabling crocodoc polling job 2017-08-22 18:26:13 +00:00
_custom_ticketing_email_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_custom_ticketing_web_post_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_diigo_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_dim_dim_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_embedded_chat_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_etherpad_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_facebook_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_github_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_google_docs_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_google_drive_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_grade_export_settings.html.erb add final grade overrides to grade sync 2019-02-21 16:04:28 +00:00
_i18n_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_inst_fs_settings.html.erb safari inst-fs service worker 2020-07-02 22:39:11 +00:00
_kaltura_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_linked_in_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_live_events_settings.html.erb Optionally configure live events via Consul 2017-05-10 16:07:41 +00:00
_mathman_settings.html.erb switch enabling mathman back to a plugin setting 2017-08-16 22:20:15 +00:00
_microsoft_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_panda_pub_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_sessions_timeout.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_settings_header.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_sis_import_settings.html.erb remove unused setting from plugin_setting 2020-03-05 16:46:16 +00:00
_ticketing_system_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_twitter_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
_unsplash_settings.html.erb Point Unsplash setup instructions to Wiki 2019-08-19 20:40:05 +00:00
_vericite_settings.html.erb Change h4 to h2 on announcements 2020-06-17 17:00:34 +00:00
_wimba_settings.html.erb da licença part 55 2017-04-28 19:42:23 +00:00
index.html.erb replace content_for :page_title or :title w/ provide 2019-07-17 17:25:51 +00:00
show.html.erb replace content_for :page_title or :title w/ provide 2019-07-17 17:25:51 +00:00