cookies check can generate very long URLs

[hmoffatt]

The cookies check takes the original login POST and turns it into a GET. I have one LMS which includes an lti_message_hint that is nearly 4k long, and this is then added to the URL.

I think the cookies check javascript could still re-send the request as a POST and this would avoid the very long URLs. The server side is only looking for the existence of the lti1p3_new_window field to determine if the check has been run or not, not the HTTP method.

[hmoffatt]

Although it's all got to go in the authentication callback to the tool consumer anyway, which is another GET, so this doesn't matter I suppose.