canvas-lms/app
Evan Battaglia f58237d341 amend CSP header to allow LTIs embedded in LTIs
This lets the retrieve and resource_selection endpoints embed inside
an iframe inside of New Quizzes.

closes INTEROP-7752
closes INTEROP-7742

Test plan:
- if you have New Quizzes set up, and they are embedding tools from
  within their tool, you might be able to test with that. Otherwise, you
  can test with LTI 1.3 test tool as mentioned below.
- modify the LTI 1.3 test tool dev key to have internal_service=true
- in the LTI 1.3 test tool's app/views/launch/launch.html.erb add an
  iframe pointing to resource_selection like this:
    <iframe
      src="http://web.canvas-lms.docker/courses/66/external_tools/181/resource_selection?parent_frame_context=155&editor=1"
      style="width: 600px; height: 400px" ></iframe>
  The parent_frame_context parameter should be your LTI 1.3 test tool
  ID. The first tool ID can be any LTI 1.1 tool (LTI 1.3 currently needs
  an additional change -- to the LTI 1.3 'authorize' endpoint -- to
  work)
- Launch the LTI 1.3 tool. Your LTI 1.1 tool should successfully launch
- Change the iframe you added above to a retrieve URL, e.g.:
    http://web.canvas-lms.docker/courses/66/external_tools/retrieve?url=http%3A%2F%2Fmylti1tool.example.com%2F&parent_frame_context=155"
- Where the URL is a URL for an LTI 1.1 tool available in the course,
  and 155 is your LTI 1.3 test tool ID

Change-Id: Ie27c030bbd95b85af60e391c14bf6c52aad087be
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/306023
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Paul Gray <paul.gray@instructure.com>
QA-Review: Paul Gray <paul.gray@instructure.com>
Product-Review: Evan Battaglia <ebattaglia@instructure.com>
2022-11-30 20:06:28 +00:00
..
controllers amend CSP header to allow LTIs embedded in LTIs 2022-11-30 20:06:28 +00:00
graphql Fix react inbox when a hard-deleted user is present 2022-11-29 19:00:14 +00:00
helpers Prevent all users from creating new conversations in soft-concluded courses 2022-11-30 17:42:29 +00:00
messages Tweak notifications for recurring event series 2022-07-11 20:29:36 +00:00
middleware Improve Sentry APM sampling decisions 2022-02-05 00:17:52 +00:00
models Make folder deletion faster 2022-11-29 16:30:43 +00:00
observers announce quizzes locked/unlocked on LiveEvents 2022-08-18 17:53:37 +00:00
presenters Course pace default heading fetch rework 2022-10-28 13:18:07 +00:00
serializers allow course-related variable expansions for NRPS 2022-07-07 15:35:00 +00:00
services/course_pacing Remove StudentViewEnrollments from pace contexts 2022-11-15 23:08:49 +00:00
stylesheets hide the external link icon on the login page, again 2022-11-16 15:48:19 +00:00
views Look for the redirect form in LTI controller specs 2022-11-30 16:55:54 +00:00