API-SecurityError Cross-Origin

[Werewolve]

Hey!
First thanks that you offer this useful project.
I followed your instruction and uploaded the module to my LMS. But still getting this error:

Error grabbing 1.2 API-SecurityError:Blocked a frame with origin "https://...." from accessing a cross-origin frame. Protocols, domains, and ports must match.

Any ideas whats wrong? Or didn't I get it right that this project is for hosting SCORM content on an other domain than the LMS is?

Thanks for helping!

[arnaudriegert]

Hi @Werewolve and thanks for reaching out. We created this project initially for internal use but we were hoping that others may find use in it, so we're very glad that you found us :)

We haven't had the occasion yet to test SCOL-R outside of our specific use case, so we are not familiar with all possible errors depending on the variety of situations.

Your error message doesn't seem to come from SCOL-R, so I'm guessing it's an issue either with your LMS or with your SCORM content.

I'd be happy to schedule a short call with screen sharing so that you could show us the problem live, because I'm not sure I understand the scenario. Feel free to reach out by email ([email protected]) if you'd like to do so, you can suggest a couple of time slots during which you're available over the next few days.

[Werewolve]

@arnaudriegert I dropped a mail. Thanks =)

[Werewolve]

I also notice that "win.addEventListener('message', function (e) {" is never called. And I can't find any code that does the postMessage. Who should do that? I tried some demo scorm modules from the internet, also there the callback is not called.
It works great with modules on the same domain, but even there the callback isn't called. So my guess is that it doesn't use the postMessage Bridge. Any ideas so far? Thanks!

[Werewolve]

I did some more research.
The problem is that the SCORM Module does not find the API property in his window. So it tries to search deeper and access the window.parent property what raises the Security Error and the loading fails.

We need a script that is kind of injected into the SCROM window under the API property name that will receives the requests from the module and will convert it to postMessages. This message then get received from the SCORMAdapter and ends in the LMS.

To archive this, I think we need to modify the scorm module itself and inject this script.
@arnaudriegert What do you think?

Currently your script does really do anything. It just works because your SCORM module and LMS is on the same domain. Right? Or am I totally wrong?

[arnaudriegert]

Hi @Werewolve I'm sorry I haven't been able to reply yet, I've had a busy week :/

However, I can confirm that we have SCOL-R working when the LMS and the SCORM module are hosted on different domains... I'll read your messages more in detail as soon as I can (Monday at the latest) and ping you on Skype if I need to see your bug live :)

[Werewolve]

Hi @arnaudriegert,
no problem, i did not want to stress you!
That sounds good, hopefully we get it also working on my side. Its really important for me to solve this challenge! Please check also the link I've send you where you can see the problem.
Hope to hear from you!

[Werewolve]

Hi @arnaudriegert,
no problem you haven't found time yet! But im still trying to solve the problem.

I've started a thread on Stack Overflow:
https://stackoverflow.com/questions/56009573/scorm-hosting-cross-origin
Maybe someone there have a clue and can help.

Would be nice if you can give me just some information about your LMS, your content streaming sever and your SCORM Module. I want to find out in which area the problem lies.

Thanks!

[abenevaut]

Hi @arnaudriegert, did you have time to check this issue ?