LTI: Use received nonce in auth - refs BT#16379

6 years ago · 46d51264e6
parent fa33f5be0e
commit 46d51264e6
1 changed files with 5 additions and 1 deletions
--- a/plugin/ims_lti/auth.php
+++ b/plugin/ims_lti/auth.php
@ -101,7 +101,11 @@ try {
    $jwtContent['aud'] = $tool->getClientId();
    $jwtContent['iat'] = time();
    $jwtContent['exp'] = time() + 60;
-    $jwtContent['nonce'] = md5(microtime().mt_rand());
+    $jwtContent['nonce'] = $nonce;
    if (empty($nonce)) {
        $jwtContent['nonce'] = md5(microtime().mt_rand());
    }
    // User info
    if ($tool->isSharingName()) {