How to validate Lti request?

Question

Hello,

I created ASP.Net Core MVC app that accesses Moodle platform. I used LtiLibrary.NetCore library to create Lti request. I registered app as Moodle External tool and added Consumer key and Consumer secret. It works okey, i got data from Moodle, but my question is necessary to validate consumer key and consumer secret from Moodle. Can anyone explain me Lti requests and what to do with validation?

Jayraj Chhaya · Answer

When dealing with LTI (Learning Tools Interoperability) requests in ASP.Net Core MVC apps, it is crucial to validate the consumer key and consumer secret received from Moodle. This validation ensures that the requests are originating from trusted sources, adding a layer of security to your application. To validate the consumer key and secret, you can compare them with the values stored in your application that were registered with Moodle as an external tool. This comparison helps confirm the authenticity of the requests and prevents unauthorized access. In your ASP.Net Core MVC app, you can implement a validation mechanism that checks the consumer key and secret before processing the LTI requests. By verifying these credentials, you can enhance the security of your integration with Moodle and protect sensitive data exchanged between the platforms.

Aleksandar Ristic · Answer

Thank you for explanation. I got successfully consumer key, but i don't know how to get consumer secret? What property to use from LtiRequest to get consumer secret, or it is necessary to validate through a signature consumer secret?