Special characters in LTI launch URLs in LTI Outcome requests are handled incorrectly

[robertknight]

We (Hypothesis) are trying to build an integration with Canvas SpeedGrader in our LTI app. When a student launches an assignment that uses our tool, we submit an LTI Launch URL to Canvas using the LTI Outcomes API's.

The LTI Launch URL we submit in the recordResult XML request looks like this:

https://lms.hypothes.is/lti_launches?url=https%3A%2F%2Fexample.com%3Fparam%3Dvalue

Note that the "url" query param is correctly percent-encoded here so eg. ":" has been replaced with "%3A".

Expected result:

When the submission is viewed in SpeedGrader, the LTI Launch URL should be used exactly as it was submitted. Given the submitted LTI launch URL above, our app should receive the query params ("url", "https://example.com?param=value") after parsing the request.

Actual result:

When the submission is viewed in SpeedGrader, the /lti_launches request that loads in the browser has doubly-encoded query params (eg. "url=https%253A...") so that after our web framework has decoded the HTTP request, it gets ("url", "https%3A%2F%2Fexample.com%3Fparam%3Dvalue").

[stale[bot]]

Thanks for contributing to this issue. As it has been 2 years since the last activity, we are automatically closing the issue in 30 days. This is often because the request was already solved in some way and it just wasn't updated or it's no longer applicable. If that's not the case, please respond before the issue is closed, or post a message on the mailing list. We'll gladly take a look again!

[robertknight]

Hello,

The issue is still occurring as far as I know and we still have a workaround for it in our app.