ilLTISessionCookie Class Reference

The session cookie of ILIAS in the LTI flows. More...

Collaboration diagram for ilLTISessionCookie:

Static Public Member Functions
static	allowCrossSite ()
	Sends the session cookie again as SameSite=None, with the path and the domain of the one PHP sends so that it replaces that one instead of adding a second cookie of the same name. More...
static	remove ()
	Removes the session cookie and the client cookie from the browser at the end of an LTI session. More...

Detailed Description

The session cookie of ILIAS in the LTI flows.

ILIAS sends it as SameSite=Lax, which keeps it from requests another site starts: the pages ILIAS shows inside the iframe of a platform, and the POST with which a tool asks for the id_token of a launch. For these the cookie is sent again as SameSite=None.

Author

Saúl Díaz sdiaz.nosp@m.@sur.nosp@m.labs..nosp@m.com

Definition at line 28 of file class.ilLTISessionCookie.php.

Member Function Documentation

allowCrossSite()

static ilLTISessionCookie::allowCrossSite ( )

static

Sends the session cookie again as SameSite=None, with the path and the domain of the one PHP sends so that it replaces that one instead of adding a second cookie of the same name.

The header is set directly, as some LTI responses are echoed by celtic/lti and never pass the HTTP service. A SameSite=None cookie must be secure; it is marked so even when ILIAS does not detect HTTPS behind a proxy, and a browser on plain HTTP just ignores it.

Definition at line 38 of file class.ilLTISessionCookie.php.

                                           : void
    {
        if (session_status() !== PHP_SESSION_ACTIVE || headers_sent()) {
            return;
        }
 
        $parameters = session_get_cookie_params();
 
        setcookie(session_name(), session_id(), [
            'expires' => $parameters['lifetime'] > 0 ? time() + $parameters['lifetime'] : 0,
            'path' => $parameters['path'],
            'domain' => $parameters['domain'],
            'secure' => true,
            'httponly' => $parameters['httponly'],
            'samesite' => 'None',
        ]);
    }

References $parameters.

Referenced by ilObjLTIToolGUI\_goto(), ilLTILoginGUI\authenticate(), ilLTIAdvantagePlatformConnection\onAuthenticate(), and ilLTIAdvantagePlatformLaunchRenderer\sendPage().

Here is the caller graph for this function:

remove()

static ilLTISessionCookie::remove ( )

static

Removes the session cookie and the client cookie from the browser at the end of an LTI session.

The headers are set directly as well: the end of an LTI session usually redirects to the platform with ilCtrl::redirectToURL(), which sends a new response and drops the cookies of the HTTP service.

Definition at line 62 of file class.ilLTISessionCookie.php.

                                   : void
    {
        if (headers_sent()) {
            return;
        }
 
        $parameters = session_get_cookie_params();
        foreach ([session_name(), 'ilClientId'] as $name) {
            setcookie($name, '', [
                'expires' => time() - 3600,
                'path' => $parameters['path'],
                'domain' => $parameters['domain'],
                'secure' => (bool) $parameters['secure'],
                'httponly' => (bool) $parameters['httponly'],
            ]);
        }
    }

References $parameters.

Referenced by ilLTIViewGUI\logout().

Here is the caller graph for this function:

---

The documentation for this class was generated from the following file:

• components/ILIAS/LTI/classes/class.ilLTISessionCookie.php