Skip to content

[lti1.3] add launch messages expiration #1171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anthonygego wants to merge 2 commits into
base: main
Choose a base branch
from
Open

[lti1.3] add launch messages expiration #1171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5afcc3d
[lti1.3] add launch messages expiration
anthonygego Sep 11, 2026
d2fbdec
[lti] do not extend lti sessions lifetime
anthonygego Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion inginious/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
__version__ = "0.9.dev0"

MARKETPLACE_URL = "https://marketplace.inginious.org/marketplace.json"
DB_VERSION = 20
DB_VERSION = 21

builtins.__dict__['_'] = gettext.gettext

Expand Down
3 changes: 2 additions & 1 deletion inginious/frontend/flask/mongo_sessions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,8 @@ def open_session(self, app, request):

def save_session(self, app, session, response):
expires = self.get_expiration_time(app, session)
session.expiration = expires
# Do not extend LTI sessions lifetime
session.expiration = expires if not session.expiration or not session.is_lti else session.expiration
session.save()

if not session.is_lti:
Expand Down
7 changes: 4 additions & 3 deletions inginious/frontend/lti/v1_3/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# This file is part of INGInious. See the LICENSE and the COPYRIGHTS files for
# more information about the licensing of this file.

from datetime import datetime
from datetime import datetime, timedelta, timezone
import logging
import hashlib

Expand Down Expand Up @@ -46,14 +46,15 @@ class MongoLTILaunchDataStorage(LaunchDataStorage):
_session_cookie_name = None

def can_set_keys_expiration(self) -> bool:
return False # TODO(mp): I think it's reasonable to clean LTI Launch messages further than a week away tho
return True

def get_value(self, key: str):
entry = LaunchData.objects(key=key).first()
return entry.value if entry else None

def set_value(self, key: str, value, exp) -> None:
LaunchData.objects(key=key).update(key=key, value=value, upsert=True)
exp_date = datetime.now(timezone.utc) + timedelta(seconds=exp)
LaunchData.objects(key=key).update(key=key, value=value, expiration=exp_date, upsert=True)

def check_value(self, key: str) -> bool:
return bool(LaunchData.objects(key=key).first())
Expand Down
14 changes: 11 additions & 3 deletions inginious/frontend/models/lti1_3.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# This file is part of INGInious. See the LICENSE and the COPYRIGHTS files for
# more information about the licensing of this file.

from mongoengine import Document, StringField, ListField, DynamicField, IntField
from mongoengine import Document, StringField, ListField, DynamicField, IntField, DateTimeField


class LTIGrade(Document):
Expand All @@ -18,7 +18,15 @@ class LTIGrade(Document):

class LaunchData(Document):
key = StringField(required=True)
context = ListField(required=True)
value = DynamicField(required=True)
expiration = DateTimeField(required=True)

meta = {'collection': 'lti_launch'}
meta = {
'collection': 'lti_launch',
'indexes': [
{
'fields': ['expiration'],
'expireAfterSeconds': 0 # use field value
}
]
}
15 changes: 9 additions & 6 deletions inginious/frontend/pages/lti/v1_3/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,8 +90,9 @@ def _handle_oidc_login_request(self, courseid):
if not target_link_uri:
raise Exception('Missing "target_link_uri" param')

launch_data_storage = MongoLTILaunchDataStorage()
oidc_login = FlaskOIDCLogin(flask_request, lti_tool(lti_config, current_app.config.get("LTI_CONFIG")), launch_data_storage=launch_data_storage)
oidc_login = FlaskOIDCLogin(flask_request, lti_tool(lti_config, current_app.config.get("LTI_CONFIG")))
oidc_login.set_launch_data_storage(MongoLTILaunchDataStorage())
oidc_login.set_launch_data_lifetime(current_app.config["PERMANENT_SESSION_LIFETIME"])
return oidc_login.enable_check_cookies().redirect(target_link_uri)

def GET(self, courseid):
Expand All @@ -112,9 +113,10 @@ def _handle_message_launch(self, courseid, taskid):
raise NotFound(description=_(str(ex)))

tool_conf = lti_tool(lti_config, current_app.config.get("LTI_CONFIG"))
launch_data_storage = MongoLTILaunchDataStorage()
flask_request = FlaskRequest()
message_launch = FlaskMessageLaunch(flask_request, tool_conf, launch_data_storage=launch_data_storage)
message_launch = FlaskMessageLaunch(flask_request, tool_conf)
message_launch.set_launch_data_storage(MongoLTILaunchDataStorage())
message_launch.set_launch_data_lifetime(current_app.config["PERMANENT_SESSION_LIFETIME"])

launch_id = message_launch.get_launch_id()
launch_data = message_launch.get_launch_data()
Expand Down Expand Up @@ -253,8 +255,9 @@ def POST(self):

# Ftech launch message from database
tool_config = lti_tool(course.lti_config(), current_app.config.get("LTI_CONFIG"))
message_launch = FlaskMessageLaunch.from_cache(message_launch_id, request=None, tool_config=tool_config,
launch_data_storage=MongoLTILaunchDataStorage())
message_launch = FlaskMessageLaunch.from_cache(message_launch_id, request=None, tool_config=tool_config)
message_launch.set_launch_data_storage(MongoLTILaunchDataStorage())
message_launch.set_launch_data_lifetime(current_app.config["PERMANENT_SESSION_LIFETIME"])

# Generate deep link response
deep_link = message_launch.get_deep_link()
Expand Down
10 changes: 10 additions & 0 deletions inginious/scripts/database_update.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
import argparse
import base64
import tzlocal
import datetime

from pymongo import MongoClient
from gridfs import GridFS
Expand Down Expand Up @@ -186,6 +187,15 @@ def main():
database.sessions.drop_indexes()
db_version = 20

if db_version < 21:
print("Updating database to db_version 21")
# Remove any older context key
database.lti_launch.update_many({"context": {"$exists": True}}, {"$unset": {"context": True}})
# Set a default expiration date for existing documents
exp_date = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(seconds=86400)
database.lti_launch.update_many({"expiration": {"$exists": False}}, {"$set": {"expiration": exp_date}})
db_version = 21

database.db_version.update_one({}, {"$set": {"db_version": db_version}}, upsert=True)

print("Database up to date")
Expand Down