Is there a way to force the Iframe for LTI applications as "sandbox"

[JavierHex]

I have a tool that follows LTI 1.3 and use cookies for authentication. When I use the tools inside Canvas(as LTI 1.3 application) and depending on the browser (e.g. chrome), the Iframe have access to third-party cookies, authenticating the user with a previous cooky from a different tab. I want to avoid this behavior on the Iframe and Canvas, so wondering if there is an option to set the Iframe as "sandbox" or something like that. Thanks in advance 

[chriscas]

Hi @JavierHex,

I'm going to move this to the developers area since it's a more technical question and you may get a better response there.  With my novice developer and Canvas administrator hats on though, I am very curious why you're using cookies for authentication...  That doesn't seem like the best path to go down, especially if cookies start to get phased out.  You should be able to use LTI to authenticate which would probably alleviate some of the issues you're seeing with the cookie method.

-Chris

[matthew_buckett]

Depending on how you handle your login one option would be to have a different final URL that the user ends up at after the LTI launch so that the placement is encoded into that final URL, that way you can set a cookie with a path of the final URL and it won't be sent on other LTI launches. 

https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#path_attribute

Locally we have switched to using single page applications and store the state of the tool in the window, then to load data we match XHR/fetch calls with an Authorization header. This allows us to support multiple independent launches working at the same time while also preventing the cookie limitations that browsers have recently introduced from causing problems for our users.