Invalid display courseware through the LTI iframe in IE 10+

[dmitry-viskov]

When using in-frame LTI navigation in IE 10 & 11, problems are not rendering properly. The problems render properly in IE 10 & 11 when using edX directly, or when opening LTI in a new tab. This is reproducible in Canvas and D2L:

This problem happens because in iframe JS couldn't get Cookie for the CSRF protection and sends always null:

So per every such question LTI server returns HTTP 403:

"POST /courses/course-v1:OrgX+CS101+qwerty1/xblock/block-v1:OrgX+CS101+qwerty1+type@problem+block@5932e9abc0224b04af13c048a174553f/handler/xmodule_handler/problem_get HTTP/1.0" 200 3847

instead of:

"POST /courses/course-v1:OrgX+CS101+qwerty1/xblock/block-v1:OrgX+CS101+qwerty1+type@problem+block@5932e9abc0224b04af13c048a174553f/handler/xmodule_handler/problem_get HTTP/1.0" 403 9976

It is connected with the cookie-restricting privacy feature called P3P. More details can be found here: http://blogs.msdn.com/b/ieinternals/archive/2013/09/17/simple-introduction-to-p3p-cookie-blocking-frame.aspx
I'v created a little fix. You could see it in this pull request. I know only one case of using iframe to display courseware so I'm not sure that this fix should be applied only for the LTI views. May be it should be used globally for all other entry points.
Display questions after the fix:

[openedx-webhooks]

Thanks for the pull request, @strannikk! I've created OSPR-1153 to keep track of it in JIRA. JIRA is a place for product owners to prioritize feature reviews by the engineering development teams.

Feel free to add as much of the following information to the ticket:

• supporting documentation
• edx-code email threads
• timeline information ("this must be merged by XX date", and why that is)
• partner information ("this is a course on edx.org")
• any other information that can help Product understand the context for the PR

All technical communication about the code itself will still be done via the GitHub pull request interface. As a reminder, our process documentation is here.

If you like, you can add yourself to the AUTHORS file for this repo, though that isn't required. Please see the CONTRIBUTING file for more information.

[dmitry-viskov]

jenkins run bokchoy

[douglashall]

@strannikk How did you come to define this P3P policy?

[dmitry-viskov]

@douglashall What do you mean? If you asking about the P3P value I've taken it from the blog article where this problem was described. This issue is very popular and could be found in many internet articles (for example on stackoverflow).

[douglashall]

@strannikk Sorry, I am not entirely familiar with P3P and I am wondering if there is a good resource which describes each of the policy values you have listed here.

[douglashall]

@strannikk Can you move the addition of this header to a Python decorator and apply the decorator to this function? Also, the policy value should be moved to a Django setting in lms/envs/common.py.

[douglashall]

@strannikk I think we should do something similar to what Facebook and Google are doing for the P3P policy, a plain-text explanation that we do not have a P3P policy. See http://stackoverflow.com/questions/8048306/what-is-the-most-broad-p3p-header-that-will-work-with-ie

[dmitry-viskov]

@douglashall Not sure. I believe in this case LTI in IE will not work properly...

[dmitry-viskov]

@douglashall Sorry. I've read the solutions on the stackoverflow. Ok. I'll try to use the facebook approach. Let's see how it turns out.

[douglashall]

Thanks @strannikk. I have tried the following locally with a Canvas consumer and it seems to work.

resp['P3P'] = 'CP="Open EdX does not have a P3P policy."'

[dmitry-viskov]

@douglashall I've updated the PR according your comments

[douglashall]

👍

[douglashall]

@robrap Can you give this a second thumb? I have tested this locally and it looks good.

[robrap]

@douglashall I think we should tag someone (who?) on legal based on the following blog article.
https://blogs.msdn.microsoft.com/ie/2012/02/20/google-bypassing-user-privacy-settings/

Thoughts?

Other than that, it looks fine.

[douglashall]

FWIW that article was written in 2012 and I think things have evolved since then. From the research I have done, P3P seems to be a dead standard that no one except for IE implements. @smagoun Is there someone in legal who can/should look at this?

[robrap]

@douglashall I did a quick search/read on my commute. If what you say is true, I'd say we shouldn't waste much time on this and I would give it a 👍 . What do you think?

[dmitry-viskov]

@douglashall Do I need to move decorator to lms/djangoapps/lti_provider/decorators.py?
Seems that the comment with this request was removed. Am I wrong?

[douglashall]

@strannikk Yes, I removed that comment after thinking about it some more. I think the location you chose is the right one.

FYI, we need to run the P3P policy by our legal team here. More to come soon.

Thanks again for raising this issue and putting in the fix.

[douglashall]

Microsoft has dropped support for P3P on all versions of IE on Windows 10.

https://msdn.microsoft.com/en-us/library/mt146424(v=vs.85).aspx