Hey,
I'm running into an issue where Moodle seems to generate invalid signatures signing LTI 1.1 launches, and I can't figure out what might be causing this or a pattern to the issue.
I have two moodle instances: one running locally, and one in a test server. I am building an LTI provider, and I started seeing errors of LTI 1.1 launches with invalid signatures. First, I thought the issue was in my implementation of the signature validation.
But then I tested both Moodle instances against a reference LTI implementation https://saltire.lti.app/tool . What I now see is that the local Moodle always gives an invalid signature error when launching to the saLTIre tool, and always works with my own LTI provider. On the other hand, the moodle on th test server always works with the saLTIre tool, yet always has an invalid signature when launching to my own LTI provider.
I have uploaded a video showing the problem here: https://streamable.com/ninfb9 . I first show that for both moodle instances I simply configure an external tool with the correct URL, the key and the secret, and then launch to the saLTIre tool. For the local instance it fails, for the one on the test server it works.
For reference, the local moodle is running 4.0.4+ Build 20221111 and the instance on a test server is running 4.1 upwards Build 2022112. And I have also tested locally with another version, 4.0.4 Build 20220912, with which I never get the invalid signature issue.
Could this be a bug in Moodle? Or am I missing something? Thanks for the help