AICC Security Communication Problem

[JodyBaty]

My organization's LMS is behind an F5 firewall.  We have about 100 eLessons in AICC published format, about half were created with Captivate 8 and half with Captivate 9. Last week, F5 published a security update to address cross-site scripting. Since then none of the Captivate 9 published lessons are working. I tried republishing those lessons with Captivate 2017 (tried FlashPlayer 10, 10.2, and 11) but no luck.

Any thoughts on why this is occuring and how we can resolve the issue?

Jody

[RodWard]

AICC relies on the ability to do cross-site scripting. It's more or less the main reason why AICC is still used at all around the world.  It allows people to have the course content on a different server to the LMS.

I think you are going to need to republish your courses as SCORM and make sure they are loaded directly into the LMS that serves them.

The people at SCORM Cloud have a method of having content on a different server, but I still think it needs to be SCORM.

[JodyBaty]

Thanks Rod & Erik. We're in the process of switching to a SCORM based LMS. Unfortunately, that won't be ready for a few months yet. I'll have to try to find a way to get the AICC working. It's weird that it works for Captivate 8 published files but not Captivate 9 or 2017.

[Erik Lord]

Rob is correct. A little more detail...

AICC is a dead protocol, the group disbanded a couple years ago.

AICC hangers it up! | eLearning Chef

There's no chance it'll be fixed from the AICC side. The only option then is to rollback the security update on the firewall, which you likely don't want to do as cross-site scripting can be a significant problem.

So as Rod states, you need a different approach. Hopefully your LMS supports SCORM or xAPI. Captivate can publish to both. Talk with your LMS vendor and see what makes the most sense and you have a bit of work to do in changing your CP project settings and republishing everything.

If your LMS does not support anything but AICC, may be time to find a new LMS...

[Erik Lord]

Oh...I did not catch that some (CP8 published) were still working and others (CP9+) were not.

I don't know why that would be.

Are the published CP8 files in the same web/folder location as the newer ones?

There is an older method to allow cross-site scripting, by placing a file on the remote site that the querying site can look for and, if found, allows it to happen. I forget the details though, and am not sure it's a current solution anyway.

BUT perhaps, if the CP8 files are in a different location, that 'allow' file exists and that's why it still works?

Otherwise I guess it's something to do with how the versions publish, but I don't know what that would be