When clicking the "Load in a new window", an error is displayed reading "invalid nonce". This appears to happen because there is no id_token sent to /lti/authorize/check, instead with errors reading:
{
"utf8":"\u2713",
"error":"launch_no_longer_valid",
"error_description":"The launch has either expired or already been cvonsumed"
}This might not be a problem if prod Canvas disallows loading LTI tools through both links to new tabs and embeds, but error feedback to the user when it happens should be improved regardless.
In Chrome:
In Firefox:
When clicking the "Load in a new window", an error is displayed reading "invalid nonce". This appears to happen because there is no id_token sent to /lti/authorize/check, instead with errors reading:
{ "utf8":"\u2713", "error":"launch_no_longer_valid", "error_description":"The launch has either expired or already been cvonsumed" }This might not be a problem if prod Canvas disallows loading LTI tools through both links to new tabs and embeds, but error feedback to the user when it happens should be improved regardless.
In Chrome:
In Firefox:
