Chrome 84: Blocked content in Canvas

On July 14, 2020, Chrome plans to enforce a new cookies model to provide protection against network attacks in its version 84 browser. Under this new model, HTTP cookies must either:

1. Originate from and be used only for the website domain in the user’s address bar, or
2. Be marked as accessible via a secure communication channel if they were to be used for a website domain different from the one in the user’s address bar. 

This model also requires web developers to properly attribute which kind of cookies they are using. Other browsers have announced plans to adopt the same approach as Chrome, although the timeline for their changes has not been made public.

The changes in default cookies settings may affect any webpage that uses third-party content. Examples of third-party content include iClicker Remote Registration, the Zoom Conference Scheduler integration, and possibly other integrated external tools such as publisher content.  This content will be blocked from being displayed if the cookies are not appropriately configured.

You are affected if:

• The content you expected to see is not displayed
• You see an error message, or
• You are prompted repeatedly to log in even though you have provided the correct username and password

Example of third-party content (iClicker Remote Registration) not displaying correctly in Chrome 80 when secure-by-default browser cookies settings are in place.

As a content consumer, you have two options to view the content:

1. Open the content in its own new window.
   Some vendors may provide an error message that includes a link to open the content in a new window.
   
   
2. Use a different browser.
   Some vendors do not provide an error message or authentication fails repeatedly. If you are using one of these tools, and you don’t have an easy way to open the content in a new browser window, then your only option is to use a different browser. At the time of writing, Firefox has not enforced the secure-by-default model for browser cookies settings.

As content creators, instructors, TAs, and course designers, should provide an option to view third-party content. In a Canvas course site, instructors and TAs can select the “Load in a new tab” option when they add External URLs or External Tools to a Module, or when adding an External Tool Assignment. We strongly recommend this approach to reduce the amount of troubleshooting and student questions, especially given that other browsers have announced plans to adopt the same approach as Chrome.

Select the Load in a new tab option when adding External URLs or External Tools to Canvas Modules.

Select the Load This Tool In A New Tab option in External Tool Canvas Assignments.

The EdTech Support (ETS) office has tested the integrated learning tools connected to Canvas available to all courses. As of February 10th, 2020, ETS has found that the following vendors still need to update their tools in order for their content to display correctly when secure-by-default browser cookie settings are in place:

 If you find any other third-party tools that are not working as expected, please report the issue by emailing canvas@ucsd.edu.

Yes, and according to WhatIsMyBrowser.com here's why:

Get the most out of the internet

Websites and cloud services, like Canvas, take advantage of new features that modern web browsers provide, such as:

• HTML5 video and audio
• Advanced JavaScript and CSS styling

If you're running something that's very out of date, you probably won't be able to use some or all of the features of the sites you visit.

Stay safe and secure

If you run a web browser that is out of date and which contains security vulnerabilities, you risk having your computer compromised by criminals. Depending on the security exploit, your personal information (including emails, banking details, online sales, photos and other sensitive information) could be stolen or destroyed. This is not a hypothetical occurrence; it happens regularly and in large volumes.

If your computer's security is compromised, you also run the risk of being used as a "middle man" in online crime by sending out thousands of spam emails; or as an unwitting pawn in large scale attacks against UC San Diego and other internet users – all without you even being aware.

• For an explanation of HTTP cookies, see: “ What Are Cookies?” by Norton by Symantec, and “ HTTP cookie” in Wikipedia.
• For an explanation of how cookies work across different websites, see: SameSite cookies explained by Rowan Merewood.
• Details of the change in Chrome v80+, to be implemented on July 14, 2020, can be found on https://blog.chromium.org/2019/10/developers-get-ready-for-new.html.
• For an updated timeline about the launch, please visit https://www.chromium.org/updates/same-site.