Hello, everyone;
I am currently developing a quiz game to work as an external tool within Moodle. I am following the IMS LTI specification and using OAuth for authentication, as it requires.
I recently managed to authenticate the launch POST request from Moodle, and am now trying to send grades back to Moodle from my tool by using LTI Basic Outcome Service.
Here is where I have encountered a problem: I build POX messages, sign the request, and send it, but for some reason they are succeeding just once every several attempts (30% of the time, more or less). For the rest of them, Moodle responds with a failure POX message that includes "Message signature not valid" as its description.
Obviously, I want to trust my requests will succeed whenever I need them to.
Any ideas on the reason this could be happening? Any suggestions on how to find out?
Thank you all in advance for your help!
For illustration purposes, I show you here below an example of a successful request and a failed one, along with each one's Base String (the one signed with the OAuth protocol):
##################################
##########Successful request###########
##################################Body hash :
hPssgohenJEvtKta2so7Y27p3kU=
Base String (line breaks are for display purposes only) :
POST&http%3A%2F%2F127.0.0.1%2Fmoodle%2Fmod%2Flti%2Fservice.php&oauth_body_hash%3DhPssgohenJEvtKta2so7Y27p3kU%253D
%26oauth_callback%3Dabout%253Ablank%26oauth_consumer_key%3Dkey%26oauth_nonce%3D63cc0764c4cc4701abe28fa5fd406378
%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1525940779%26oauth_version%3D1.0
Body:
<?xml version="1.0" encoding="UTF-8"?>
<imsx_POXEnvelopeResponse xmlns="http://www.imsglobal.org/services/ltiv1p1/xsd/imsoms_v1p0">
<imsx_POXHeader>
<imsx_POXResponseHeaderInfo>
<imsx_version>V1.0</imsx_version>
<imsx_messageIdentifier>1602471533</imsx_messageIdentifier>
<imsx_statusInfo>
<imsx_codeMajor>success</imsx_codeMajor>
<imsx_severity>status</imsx_severity>
<imsx_description>Result read</imsx_description>
<imsx_messageRefIdentifier>961216995</imsx_messageRefIdentifier>
<imsx_operationRefIdentifier>readResultRequest</imsx_operationRefIdentifier>
</imsx_statusInfo>
</imsx_POXResponseHeaderInfo>
</imsx_POXHeader>
<imsx_POXBody>
<readResultResponse>
<result>
<resultScore>
<language>en</language>
<textString>0.5</textString>
</resultScore>
</result>
</readResultResponse>
</imsx_POXBody>
</imsx_POXEnvelopeResponse>
###############################
##########Failed request###########
###############################Body hash = YLigJE+8wr7rCwOITqdc1IP3zFs=
Base String :
POST&http%3A%2F%2F127.0.0.1%2Fmoodle%2Fmod%2Flti%2Fservice.php&oauth_body_hash%3DYLigJE%252B8wr7rCwOITqdc1IP3zFs%253D
%26oauth_callback%3Dabout%253Ablank%26oauth_consumer_key%3Dkey%26oauth_nonce%3D6de4380ce2ab4d9a90e3fe1723dc5141
%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1525940816%26oauth_version%3D1.0
<?xml version="1.0" encoding="UTF-8"?>
<imsx_POXEnvelopeResponse xmlns="http://www.imsglobal.org/services/ltiv1p1/xsd/imsoms_v1p0">
<imsx_POXHeader>
<imsx_POXResponseHeaderInfo>
<imsx_version>V1.0</imsx_version>
<imsx_messageIdentifier>1688463600</imsx_messageIdentifier>
<imsx_statusInfo>
<imsx_codeMajor>failure</imsx_codeMajor>
<imsx_severity>status</verity>
<imsx_description>Message signature not valid</imsx_description>
<imsx_messageRefIdentifier/>
<imsx_operationRefIdentifier>unknownRequest</imsx_operationRefIdentifier>
</imsx_statusInfo>
</imsx_POXResponseHeaderInfo>
</imsx_POXHeader>
<imsx_POXBody>
<unknownResponse/>
</imsx_POXBody>
</imsx_POXEnvelopeResponse>