Lock LTI link behavior

If you use an LTI Class link, from your LMS, that link is editable by the user, after the session has started. This allows the user to figure out, in which classes the user are enrolled, even though the LMS possibly does not expose other LTI Class links to that user. (They just go through the UIDs of the classes, starter with '0')

It might also (We do not know) be possible, to edit the LTI Class link, to a LTI system frontpage link, which we normally never expose to students, via the LMS. We do not want students on the möbius system front page.

We propose that LTI Links only allow what they originally reference. We believe LTI Assignment links already behaves in this manner, but that should be true for LTI Class links as well. So if you click "Class A LTI Class link", that will only grant access to Class A front page and all content relevant for that class. Users should not be able to use that session, to enter Class B, even if they are enrolled in that class too. If they want access to Class B, they should use the "Class B LTI Class link". An Assignment link should not grant access to a class front page either, or other assignments, than what the link originally referenced. 

If you use a LTI System frontpage link", that will grant access to "everything" the user has access to, as it does today.

  • Michael Clasen Jacobsen
  • Sep 11 2019
  • Attach files