Forum Discussion
New in Labs: Connected Packages
Hi all, just some feedback and info for anyone who may be using the code blocks.
Connected packages change the runtime origin to packages.articulateusercontent.com (instead of the LMS). This prevents custom HTML/JS blocks from accessing LMS parent-frame context that was previously available in static SCORM exports, such as the launch URL, parent DOM context, content ID, and LMS/session metadata.
This also affects custom interactions that previously relied on LMS-side context to trigger platform actions, for example learners giving feedback actions such as liking content from within a RISE course.
I am not an expert but I understand that direct access/cross scripting to parent-frame session tokens is likely restricted for security reasons. Is there a supported way to pass safe LMS/container context into connected packages, such as launch URL, content ID, learner ID, custom query parameters, SCORM variables, or a secure postMessage/API mechanism for platform actions?
Adam_P, thanks for the detailed breakdown.
You've diagnosed it correctly. Connected Packages load from packages.articulateusercontent.com, which is a different origin than your LMS. Browsers enforce strict cross-origin rules that block direct access to the parent frame, so LMS context like launch URL, learner ID, and session metadata is no longer accessible the way it was in standard SCORM exports, this is a browser-level security restriction, not something Rise-specific.
There's no supported mechanism today for passing LMS context into Connected Packages. Can you share more details about your use case so we can evaluate it in more detail?Thanks for your reply catganim. What I am doing is really just experimental with what I can and cannot do with code blocks and the LMS. So I am also still finding out what can and cannot be done. Our LMS is quite limited as far as I can see with their API so this is something I will also speak to them about in terms of what can be accessed.
What I am currently doing is obtaining the contentID from the parent LMS page using it's URL, and then reading meta data to find csrf and auth token to validate and authorise an LMS platform action, in this case - liking content. This means a learner can like the RISE content on the LMS platform from within the course itself. Hope that helps.
