41 Commits (55c6aba9727b0243045cf056b0137e55beeefaed)

Author	SHA1	Message	Date
pgajdos	1c3dbcc6bf	do not use nose for testing	5 years ago
Sai Rahul Poruri	9dd2af27de	CLN : Remove utf8 coding cookies ... On Python 3, the default source file encoding for Python files is utf-8 and because Python 2 is no longer supported, the utf8 coding cookies can be removed	5 years ago
Remi Rampin	617f7468fe	Implement password hashing with bcrypt (#3793) ... * Use bcrypt for notebook.auth.security * Add bcrypt to install_requires * Add test for bcrypt * Switch to argon2-cffi	6 years ago
Bibo Hao	9775af7bba	Update security.py	6 years ago
Bibo Hao	8d43f50f04	Ensure jupyter config dir exist ... The bug: When - the user login for the first file with a token and want to change his/her password - and if the folder `~/.jupyter` (`jupyter_config_dir()`) does not exist then the jupyter server will raise a `FileNotFoundError` exception and return a 500 error. This change tries to fix this bug by ensure the folder exist so that the `config_file` can be opened.	6 years ago
Kerwin.Sun	b5f5c9500e	remove py2 dependence	6 years ago
Min RK	08c4c89818	protect against chrome mishandling backslash as slash in URLs	7 years ago
Min RK	b9d9e659e9	parse urls when validating redirect targets ... simplifies check for redirects to external hosts	7 years ago
Thomas Kluyver	56d7a2d3a6	Remove one-time token code	7 years ago
Denis Ledoux	3729dd02ac	[FIX] notebookapp, auth: `get_secure_cookie` kwargs ... Per Tornado's documentation: >By default, Tornado’s secure cookies expire after 30 days. >To change this, use the expires_days keyword argument to >set_secure_cookie and the max_age_days argument to get_secure_cookie. >These two values are passed separately so that you may >e.g. have a cookie that is valid for 30 days for most purposes, >but for certain sensitive actions >(such as changing billing information) >you use a smaller max_age_days when reading the cookie. With the current implementation in `auth/login.py`, this is possible to pass the `expires_days` option but not possible to enforce it as this is not possible to pass `max_age_days` to `get_secure_cookie` This makes impossible to set the cookie expiration without using a custom `LoginHandler`. This revision is about adding the possibility to pass options to Tornado's `get_secure_cookie` method, so it can be possible to set the cookies expiration, among others.	8 years ago
Thomas Kluyver	61972480b9	Don't clear login cookie on requests without cookie ... Clearing the secure cookie makes sense when it is invalid or expired, but clearing it when it's not sent with a request can unexpectedly log the user out. I ran into this with misconstructed URLs which didn't incorporate base_url. That was itself a bug, but the result of suddenly being unauthenticated makes it harder to track down. Closes gh-3365 (hopefully) Possibly also relevant to gh-2396 I'm not sure why this seems to affect Firefox more than Chrome.	8 years ago
maartenbreddels	772544e60f	renamed manager.py to config_manager.py and added more docstrings	8 years ago
maartenbreddels	89b32e4412	allow default json files in a .d directory, original PR: ipython/traitlets#452	8 years ago
Matthias Bussonnier	eca4c71056	Extra self	8 years ago
Matthias Bussonnier	a8971410c1	Add option disabled changing password at login. ... Document the changing of password.	8 years ago
Matthias Bussonnier	709fdd637a	When login-in via token, let a chance for user to set the password ... When token is enabled, the login page will present a form to the user asking them if they want to set a password at the same time. This is almost equivalent to running `jupyter notebook password` on the command line. The experience can likely be better, but just submitting that as a POC for feedback	8 years ago
Min RK	fea2ef258f	set cookie on base_url ... avoids clobbering cookies when multiple notebook servers are run on one host. Users can override `cookie_options.path = ‘/‘` if they *want* cookies to be shared across notebooks on one host.	8 years ago
Min RK	68a514a29d	Merge pull request #2033 from vlimant/master ... simple overload of passwd_check	9 years ago
Kyle Kelley	f5f97d1f93	Merge pull request #2007 from minrk/password ... add `jupyter notebook password` entrypoint	9 years ago
jean-roch	6ab3a5c098	correcting function definition	9 years ago
vlimant	ab019aae74	allows to overload the method to check unix-type password using crypt	9 years ago
Min RK	53f809d407	use a warning for failure to set file permissions ... instead of print	9 years ago
Min RK	cd7e0a939c	add `jupyter notebook password` entrypoint ... records, hashes, and stores password in json config	9 years ago
Min RK	86c6268f64	prose review	9 years ago
Min RK	70e79a0ad6	add token_authenticated property ... indicates if a token is used for authentication, in which case xsrf checks should be skipped.	9 years ago
Srinivas Reddy Thatiparthy	161c174a98	rename log.warn to log.warning as log.warn is deprecated	9 years ago
Min RK	1e070a50f5	don't check origin on token-authenticated requests ... adds LoginHandler.should_check_origin classmethod API	9 years ago
Min RK	5d5d063746	Look for token in Authorization header ... matches JupyterHub, Kernel Gateway	9 years ago
Min RK	bf249669e1	call it token ... login_token is redundant	9 years ago
Min RK	5a6d7556af	allow entering login token at password prompt	9 years ago
Min RK	cd3c6c1b8a	use one-time token for opening browser ... first connection consumes the token, so command-line snoops can’t re-use it.	9 years ago
Min RK	3ba68d8cb7	enable token-authentication by default ... - add NotebookApp.login_token, used when NotebookApp.password is not set - store login_token, bool(password) in notebook server-info file - `jupyter notebook list` shows pasteable URLs with token General changes: - notebook servers are now authenticated by default - first connect with token sets a cookie - once a user has logged into one server with a token, their browser is logged in to all subsequent servers on the same system+port until cookie_secret changes	9 years ago
Min RK	6c5cca1328	Make login_available method LoginHandler.get_login_available ... There was a conflict for the .login_available property on LoginHandler itself causing the login form to render incorrectly when login_available should be False	9 years ago
Min RK	37349b9953	include cross-origin check when allowing login URL redirects	10 years ago
Min RK	07c4d23cad	make cookies httponly by default ... we don't need or want cookie access in js	10 years ago
Min RK	417b17450e	Add `cookie_options` to make cookie args configurable	10 years ago
Maarten A. Breddels	5a3272f771	fixed a typo, and corrected the help text	10 years ago
Maarten A. Breddels	b9d106a808	implemented changes as discussed at PR 775, password generation moved to module	10 years ago
Chris Seymour	6880715826	Use a 401 status code for invalid login attempts. Fixes #384	11 years ago
Min RK	acbe5cc442	restrict login redirect to notebook app ... prevents redirect to other websites from login page	11 years ago
Min RK	d71a59cc9f	s/jupyter_notebook/notebook	11 years ago