Duplicate query string value issue

Question

Duplicate query string value issue

andrew-gardener opened this issue 7 years ago · comments

Currently the consumer or provider will include duplicate attributes that appear in the query string and body when calculating the signature.

This is an issue with some LTI consumers like Canvas that will duplicate any query string parameters into its launch request body (using the parameter only once in the signature)

Ryan Hiebert · Answer 1 · Fri Jun 23 2017 22:31:13 GMT+0800 (China Standard Time)

That's very odd. It seems like this would be a bug in Canvas, since they aren't signing the request following the OAuth spec? Is there a related issue on the instructure/canvas-lms repository?

Andrew Gardener · Answer 2 · Sat Jun 24 2017 01:14:08 GMT+0800 (China Standard Time)

Nevermind, looked into the spec more and found out it is a Canvas implementation issue (instructure/canvas-lms#600). Sorry for the trouble

Ryan Hiebert · Answer 3 · Sun Jun 25 2017 01:31:19 GMT+0800 (China Standard Time)

I do think, if there's an issue in canvas that needs fixed, that it may be reasonable for this library to put in place a workaround.