Re: Has Moodle deprecated LTI 1.1?

Thanks pointing out some of the documentation is in need of updating, the second document should mention LTI 1.1 is also deprecated. I'll look to get that updated.

For reference Moodle has not been able to certify LTI 1.1 since 2021 and LTI 1.0, 1.1, 1.1.1, .1.2 and 2.0 have been completly deprecated by 1EdTech since 2022 or earlier. There are known security issues with LTI 1.1 particularly as it uses the OAuth 1.0 which has known issues, specifically session fixation attacks which could allow a user to get unauthorised access to things like grade endpoints and PII amoung other issues with the standard. We are not removing LTI 1.1 support as there are still a very large number of tools that have not moved to LT I1.3, but equally there will be no HQ resources dedicated to resolving LTI 1.1 related issues. We may accept community patches from time to time related to LTI 1.1 but they wont be a priority. At the moment any community contributions are on hold as we are migrating LTI from a module to core, this is only temporary however.

1EdTechs Notice of Deprecation
https://www.1edtech.org/lti-security-announcement-and-deprecation-schedule