fix: WCAG 2.2 compliance and Snyk security vulnerability fixes

[devin-ai-integration]

fix: WCAG 2.2 compliance and Snyk security vulnerability fixes

Summary

Two categories of changes: WCAG 2.2 accessibility and Snyk-class security fixes for the xAPI LMS Integration app.

WCAG 2.2:

• Replaced the empty index.jsp with a fully WCAG 2.2 compliant landing page (skip nav, landmark roles, heading hierarchy, focus indicators, accessible table, color contrast, responsive viewport)
• Added accessible custom error pages (404.html, 500.html) under WEB-INF/error/

Security / Snyk:

• Upgraded web.xml from ancient Servlet 2.3 DTD to 3.1 schema
• Bumped dependency versions in pom.xml:
  • smiley-http-proxy-servlet 1.6 → 1.12
  • commons-validator 1.4.1 → 1.9.0
  • servlet-api 2.3 → javax.servlet-api 3.1.0
  • basiclti-util 1.2.1-SNAPSHOT → 1.2.0 (stable release)
• Added SecurityHeadersFilter (X-Frame-Options, CSP, X-Content-Type-Options, Referrer-Policy, etc.)
• Added session security config (HttpOnly + Secure cookies, 30-min timeout)
• Added custom error pages to prevent stack trace leakage
• Fixed empty catch block in AuthFilter → now logs warnings
• Added open redirect protection in SSOServlet (domain allowlist)
• Replaced catch(Throwable) with catch(Exception) + logging in SSOServlet
• Replaced HashMap with ConcurrentHashMap in SessionDatabase for thread safety

Review & Testing Checklist for Human

⚠️ CRITICAL - These changes have NOT been build-tested and may break the application:

• Build the project (mvn clean package) to verify dependency changes don't cause compilation failures. The servlet-api artifact ID changed from servlet-api to javax.servlet-api and versions jumped significantly.
• Test LTI integration in an iframe — the new X-Frame-Options: DENY header will break iframe embedding. If this app is meant to be embedded in an LMS (common for LTI), you need to change this to SAMEORIGIN or remove it entirely.
• Configure the open redirect allowlist — the ALLOWED_REDIRECT_DOMAINS set in SSOServlet is empty, which means the open redirect protection is inactive by default. You need to populate this with trusted activity provider domains, or the security fix is a no-op.
• Review the CSP policy — default-src 'self' may block legitimate external resources (CDNs, analytics, etc.). Test all pages to ensure nothing breaks.
• Verify deployment environment supports Servlet 3.1 — the web.xml schema upgrade requires a Servlet 3.1+ container (Tomcat 8+, Jetty 9+, etc.).

Notes

• The Cache-Control: no-store, no-cache headers are applied to all responses via the /* filter mapping. This may hurt performance for static assets. Consider narrowing the filter scope if needed.
• The new index.jsp is informational only. If you had a different landing page in mind, replace it.
• Session timeout is set to 30 minutes. Adjust if needed.

---

Link to Devin run: https://app.devin.ai/sessions/c996985933824d91af2515e6013d98d0
Requested by: @sandeepparekh-droid

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring