From 5de77314bd3808014d2fd87c1d68911e7c4896ed Mon Sep 17 00:00:00 2001
From: Min RK <benjaminrk@gmail.com>
Date: Fri, 3 Feb 2017 11:13:55 +0100
Subject: [PATCH] remove token query parameter from pages on load

Once the page has been loaded, the token has done its job and can be discarded.
Its presence can lead to confusion, especially copying/pasting URLs with one-time tokens present.
---
 notebook/templates/page.html | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/notebook/templates/page.html b/notebook/templates/page.html
index e9c56c865..e4d641c6b 100644
--- a/notebook/templates/page.html
+++ b/notebook/templates/page.html
@@ -156,6 +156,32 @@
 {% block script %}
 {% endblock %}
 
+<script type='text/javascript'>
+  function _remove_token_from_url() {
+    if (window.location.search.length <= 1) {
+      return;
+    }
+    var search_parameters = window.location.search.slice(1).split('&');
+    var found = false;
+    for (var i = 0; i < search_parameters.length; i++) {
+      if (search_parameters[i].split('=')[0] === 'token') {
+        // remote token from search parameters
+        search_parameters.splice(i, 1);
+        var new_search = '';
+        if (search_parameters.length) {
+          new_search = '?' + search_parameters.join('&');
+        }
+        var new_url = window.location.origin + 
+                      window.location.pathname + 
+                      new_search + 
+                      window.location.hash;
+        window.history.replaceState({}, "", new_url);
+        return;
+      }
+    }
+  }
+  _remove_token_from_url();
+</script>
 </body>
 
 </html>