Update lti2_nonce value varchar size on wiki

[senyah]

I'm new at this but I struggled for longer than I'd like to admit to make this library work for me. After plugging in lots of print statements, among other things, I discovered this error PDOStatement::execute(): SQLSTATE[22001]: String data, right truncated: 1406 Data too long for column 'value' at row 1 in <FILE_PATH>. Apparently the nonce value being sent from my test instance of Canvas was 43 characters long. I'm not sure if there is a way to limit the size sent from Canvas, but I ended up increasing the value varchar(32) size to varchar(255) in the lti2_nonce table.

I imagine others using this library will, or already have, encountered this but I'd like to have the wiki updated to help others in the future.
Here is the place on the wiki: https://github.com/IMSGlobal/LTI-Tool-Provider-Library-PHP/wiki/Installation#mysql

Here is the section I'm referring to:
CREATE TABLE lti2_nonce (
consumer_pk int(11) NOT NULL,
value varchar(32) NOT NULL,
expires datetime NOT NULL,
PRIMARY KEY (consumer_pk, value)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

I propose changing the third line to value varchar(255) NOT NULL, or some other size greater than 32.

[renaatdemuynck]

I experienced the same issue with Canvas. The proposed change fixes the issue.

[renaatdemuynck]

I have a fix but am not allowed to create a pull request for the wiki repo :-(

[eddimull]

Wow, haha. I was looking to make a pull request with the exact same fix and wanted to check if anyone else ran into this. I had literally the exact same scenario coming from canvas and the nonce length being 43 characters. I'm with @senyah on this issue of upping the limit on the table. I'd also suggest throwing a better exception to reflect the limit.

I didn't see this because of the OAuthException which made no sense. "Nonce already used". The table was completely empty. I got to the same conclusion by trying to manually write the nonce record to the table.

[MichaelCStevens]

I recently solved this same issue. It was not the easiest to debug because of what @eddimull has mentioned. I actually got lucky and compared the nonce it was sending vs a valid launch and immediately noticed it was longer.

Can we tag @spvickers or other past contributors?

[renaatdemuynck]

I emailed Steven Vickers some time ago and apparently he's not working for IMSGlobal any more. Since I got the feeling this project is pretty much dead I started working on my own LTI library project.

[eddimull]

Hey, @MichaelCStevens and everybody else reading this, just a heads up. I ran into another thing, but nobody has been complaining about this. If you get past this point and arrive at the outcomes point, you might have a bad time if you do not pull the right package. In the last commit curl_setopt($ch, CURLOPT_SSLVERSION,3); was commented out. If you are using Canvas LMS, the score will never actually get sent back and no errors are thrown because SSLv3 is disabled. In composer, you HAVE to use version dev-master instead of version 3.0.2. Even though 3.0.2 should have the SSL Version commented out, it does not.