From 2dc10f656baa91aa5df799668090bc4bf1333016 Mon Sep 17 00:00:00 2001 From: Jake Dallimore Date: Thu, 15 Feb 2024 12:17:29 +0800 Subject: [PATCH] MDL-80835 enrol_lti: add partitioning support for OIDC state cookie Adds the property that is required by Chrome to opt-in to its 3rd party cookie partitioning solution, CHIPS. This specific change ensures the 'state' cookie, used in the OIDC handshake, has partitioning support. This cookie can be partitioned unconditionally, since it's a cookie controlled by the library and one we don't expect to be set without partitioning elsewhere. --- lib/lti1p3/readme_moodle.txt | 1 + lib/lti1p3/src/ImsStorage/ImsCookie.php | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/lib/lti1p3/readme_moodle.txt b/lib/lti1p3/readme_moodle.txt index 4468b2f759d..8f1d1d352f4 100644 --- a/lib/lti1p3/readme_moodle.txt +++ b/lib/lti1p3/readme_moodle.txt @@ -4,6 +4,7 @@ This library is a patched for use in Moodle - it requires the following changes 1. Removal of phpseclib dependency (replaces a single call with openssl equivalent) 2. Apply the fix from https://github.com/packbackbooks/lti-1-3-php-library/pull/107. If this is already merged upstream, please remove this line. +3. The Packback\Lti1p3\ImsStorage\ImsCookie::setCookie() method has been locally patched to opt-in to Chrome cookie partitioning. To upgrade to a new version of this library: 1. Clone the latest version of the upstream library from github: diff --git a/lib/lti1p3/src/ImsStorage/ImsCookie.php b/lib/lti1p3/src/ImsStorage/ImsCookie.php index a98175e2d79..6c6b4c479e7 100644 --- a/lib/lti1p3/src/ImsStorage/ImsCookie.php +++ b/lib/lti1p3/src/ImsStorage/ImsCookie.php @@ -2,6 +2,7 @@ namespace Packback\Lti1p3\ImsStorage; +use auth_lti\local\ltiadvantage\utility\cookie_helper; use Packback\Lti1p3\Interfaces\ICookie; class ImsCookie implements ICookie @@ -33,6 +34,9 @@ class ImsCookie implements ICookie setcookie($name, $value, array_merge($cookie_options, $same_site_options, $options)); + // Necessary, since partitioned can't be set via setcookie yet. + cookie_helper::add_attributes_to_cookie_response_header($name, ['Partitioned']); + // Set a second fallback cookie in the event that "SameSite" is not supported setcookie('LEGACY_'.$name, $value, array_merge($cookie_options, $options)); }