Content domain
The content domain is a separate address for content, that is, a second web address through which OpenOlat delivers content that authors and participants upload: HTML pages, CP learning content (content packages), SCORM packages, submitted documents and similar files. You continue to call up OpenOlat itself under the usual address. The second address protects your OpenOlat session, that is, your current login to OpenOlat, from program code contained in such content.
Why a second address?
An HTML page or a SCORM package can contain JavaScript. If OpenOlat delivers this content under its own address, the script runs with the same rights as OpenOlat. It could read the OpenOlat session of the person who opens the content and act on their behalf. If a person with administration rights opens such content, the whole system would be open to the script.
The content domain prevents this with a rule that every browser enforces, the same-origin policy: a page may only access data of the same address. Content from the content domain therefore reaches neither the session cookie of OpenOlat nor the OpenOlat page in which it is embedded. This also applies when OpenOlat shows the content in a frame (iframe) directly on the course page.
One narrow channel remains open: the content can send OpenOlat a message, for example "Open this course element". OpenOlat checks every message before it executes it. This is how links from an HTML page to other parts of the course work.
Why is an isolated frame not enough?
Browsers can isolate a frame with the attribute sandbox. For learning content, this is not enough. SCORM packages need full JavaScript, and embedded videos from YouTube or Vimeo access the surrounding page. If the frame allows scripts and at the same time access to the address of the surrounding page (the same origin), the isolation cancels itself out. If someone opens the frame in a new tab, it has no effect at all. A separate address protects in all these cases.
What you notice
In everyday use, nothing changes for you: the content appears as usual on the course page or in a lightbox, for example a submitted HTML file in the course element "Task". The address bar of your browser continues to show the OpenOlat address, because the content runs in a frame within the OpenOlat page.
You only see the content domain in these cases:
- You open the content itself or a file embedded in it in a new tab.
- You look at the page with the developer tools of your browser.
The different address is intended and not a sign of an attack. The content domain never asks for username and password. You can tell whether your instance uses a content domain by exactly this different address. In the new tab and after reloading the page, the content appears completely, with images, formatting and course layout.
When content does not load
Many organisations use a web filter, for example in the firewall, to check which addresses the browsers in their network may call up. If the web filter blocks the content domain, none of the content that comes through it loads. This usually shows up first with a course element "HTML page", with an HTML page as the overview of a course element "Structure" and with links from such pages to OpenOlat pages.
The IT department of your organisation releases the content domain in the web filter. You can see which address your instance uses when you open content in a new tab. For instances operated by frentix, the address is given in the section Setup.
Which content comes through the content domain
If a content domain is set up, OpenOlat delivers the following content through it:
- Course element HTML page, also in the preview that a course element "Structure" shows with the overview "Automatic overview incl. preview"
- Course element CP learning content
- Course element SCORM 1.2
- Course element Structure with its own HTML page as overview
- Course elements Task and Group task: assignment, submitted documents and sample solution
- Course element Document with an HTML file
- Preview of an HTML file that you select in the course editor, in the course elements "HTML page", "Structure" and Test
- Content from edu-sharing embedded in an HTML page
- HTML files in folders and in projects, if you may only read the file
- Preview of certificates
- Info pages in the document pool and in the question bank
- Imprint
Links in content
Course-internal links in HTML pages, for example to another course element, also work through the content domain. OpenOlat receives the link as a checked message and opens the target. You do not need to adapt existing pages.
Links to OpenOlat pages in this content or in a PDF file displayed in the course open the target in the OpenOlat window itself, not in the frame of the content. With Ctrl-click, Cmd-click or the middle mouse button, the target opens in a new tab under the OpenOlat address. Bookmarks to an address of the content domain and passed-on addresses of the content domain lead to the OpenOlat address.
Setup
frentix customers
For instances operated by frentix, the content domain is located below elearning-content.com. If your organisation protects OpenOlat with its own web application firewall, it needs its own public content domain in addition to the public OpenOlat address. A subdomain of the OpenOlat address is not sufficient. The address shown then has a different name, the principle remains the same: two addresses for the same OpenOlat. In the web filter, release the content domain that your instance uses.
Contact
The content domain is part of the server configuration, and a change only takes effect after the next restart of OpenOlat. For a change, contact your organisation.
The following applies to system administrators:
- The content domain needs a domain of its own that does not share cookies with the OpenOlat address. A subdomain of the OpenOlat address, such as
content.learn.example.comforlearn.example.com, is not sufficient because it can share cookies with the OpenOlat address. - Both addresses point to the same OpenOlat server, for example via an additional virtual host in the reverse proxy.
- Without a content domain, OpenOlat delivers the content via its own address, without this protection. In some places, OpenOlat therefore removes the scripts from HTML files, for example from the assignment allocated in the course element "Task". HTML files in folders with read-only access open in a new browser window instead of in the lightbox.
- In the system administration, accesses via the content domain appear under Active sessions with the mode "Content":
Administration > System > Active sessions. Such a session only serves to deliver the content and never becomes a full OpenOlat session.
The setup is described in the Installation guide.
Origin of the technology
With the content domain, OpenOlat follows a procedure that large platforms have been using for years:
- Google is regarded as the pioneer. Google delivers content from users, such as file previews from Google Drive, images and Google Sites, via its own domain
googleusercontent.comand described the approach in 2012 in the post Content hosting for the modern web. - GitHub delivers files from repositories in raw form via
raw.githubusercontent.com. - The basic idea of separating security-critical web addresses from other content is described in the draft Isolated Origins of the W3C community group WICG (2017).
Further information
Mentioned on this page
Course Element "HTML page" >
Course Element "CP learning content" >
Course Element "SCORM 1.2" >
Course Element "Structure" >
Course Element "Task" >
Course Element "Group Task" >
Course Element "Document" >
Course Element "Test" >
Course Element "edu-sharing" >
Folder concept >
Projects: Files >
System >
Installation guide >
Content hosting for the modern web >
Isolated Origins >
Further reading
Videos in course element "HTML page" >
Technology and Navigation >