31 Commits (efdbef117f17ecdf1b8bbae00aabdcef141d6f02)

Author	SHA1	Message	Date
Min RK	c5bb329bf8	use tornado xsrf token in API ... - Cookie-authenticated API requests must use set X-XSRFToken header - add utils.ajax for making ajax requests, adding xsrf header from default location	9 years ago
Min RK	fb8640a072	add token_authenticated property ... indicates if a token is used for authentication, in which case xsrf checks should be skipped.	9 years ago
Min RK	8abc6dff77	enable tornado xsrf cookie	9 years ago
Min RK	6ada253bd9	Backport PR #1975: add Authorization to allowed CORS headers ... so that CORS requests can use token authentication in the Authorization header by default. cf https://github.com/jupyterlab/jupyterlab/pull/1416 Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Kyle Kelley	8f85f90b59	Backport PR #1947: Ensure variable is set if exc_info is falsey ... Closes gh-1940 Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Min RK	5c5c45fc5d	Backport PR #1939: Add debug log for static file paths ... Too often I'm trying to track down an errant extra static file path (like some javascript installed in some obscure place). This makes it easy to see exactly what is being served. Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Kyle Kelley	ab791441b2	Backport PR #1938: don't check origin on token-authenticated requests ... adds LoginHandler.should_check_origin classmethod API While testing, I noticed that we were checking origin and authentication on CSP violation reports, but browsers are sending CSP reports with no Origin, meaning that no CSP report will ever be accepted. That doesn't make sense to me, so I disabled both - a CSP report can now be made from *anywhere* (no auth, no check). rgbkrk does that sound right to you? Or should it be authenticated but no origin check? Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Min RK	c93bbb3dc9	Backport PR #1903: Allow websocket connections from scripts ... scripts don't set origin on connection we allow these on API requests, websockets should match. cc rgbkrk: is there a reason we block 'missing origin' websockets when we allow the same for API requests? Is it possible for a request from a sensible browser to be missing Host and/or Origin?	9 years ago
Kyle Kelley	754f397e9e	Backport PR #1831: enable token-authentication by default ... - add `NotebookApp.login_token`, used when `NotebookApp.password` is not set - store login_token, bool(password) in notebook server-info file - token is passed in the URL as `?token=long-token` - `jupyter notebook list` shows pasteable URLs with token Practical effects: - notebook servers are now authenticated by default - first connect with token sets a cookie - once a user has logged into one server with a token, their browser is logged in to all subsequent servers on the same system+port until cookie_secret changes. - users can no longer type the simple host:port into their browser to connect, until after the first successful login via token(simple URLs are fine if password is enabled). Truly public servers, such as tmpnb, will need to set `NotebookApp.token=''` to fully disable auth. cc Carreau, ellisonbg, rgbkrk, parente	9 years ago
Min RK	9f28479c23	Backport PR #1518: Allow requests to POST in OPTIONS requests ... Commit 65eb248209 introduced a bug by not allowing the POST method in OPTIONS requests (which is wrong since several parts of the API accept POST requests, for example creating a new kernel).	10 years ago
wenjun.swj	797d7541a8	Backport PR #1631: scape file names in attachment headers ... encode file name in Content-Disposition when it contains non-ascii characters	10 years ago
Min RK	46b6829839	Backport PR #1325: Fix handling of preflight requests ... Hi, I believe I've found a bug in the way that OPTIONS requests are handled by the notebook server. Pre-flighted OPTIONS requests do not include authentication information, which means that we should not expect these to be authenticated and so should not be using the @web.authenticated decorator. Authentication will be validated when the real PUT/POST etc request is issued after the preflight. FWIW this behaviour is documented by others in different contexts (see for example: http://giix.nl/2015/03/10/cross-origin-resource-sharing-cors-and-kerberos-webserver-auth/). ...	10 years ago
Min RK	e4f5d040d1	Backport PR #931: Add simple iopub message rate limiter ... This is designed to alleviate notebook crashes due to an excess of messages passed to the frontend. This is a small part of a solution to the bigger problem. I mainly opened this PR to help students in @ellisonbg 's class this quarter avoid crashing their notebooks and losing data.	10 years ago
Min RK	8aa4f1e60c	allow zmq check_origin with no args ... terminado may call `self.check_origin()` in which case we should grab origin from the headers.	10 years ago
Steven Silvester	fe03de7471	Avoid error when using a cross-origin websocket	10 years ago
Jeroen Demeyer	17b3643891	Interpret mathjax_url relative to base_url	10 years ago
Min RK	c2c39a7c9d	move common websocket methods to WebSocketMixin ... - origin check - ws ping used by both kernels and terminals	10 years ago
Jonathan Frederic	831b2a523b	Merge pull request #472 from minrk/base-url-always-encoded ... avoid double-encoding base_url	10 years ago
Steven Silvester	65eb248209	Add the method to the correct base class	10 years ago
Min RK	8de725a8de	server-side fixes for double-escaped base_url	10 years ago
Zach Schwartz	2e16713e32	moved check_origin to IPythonHandler	10 years ago
Matthias Bussonnier	2d5d548d79	Revert "Use NPM, node ES5, and browserify."	11 years ago
Jonathan Frederic	81a2998fe0	Dynamically load contents, also browserify contents.	11 years ago
Matthias Bussonnier	d4b1e9aa99	Wrong default. ... Change from True to False after rename from use_bundle to ignore_minified_js	11 years ago
Matthias Bussonnier	f9ad56e206	Add option to not use minified javascript and ease developpement.	11 years ago
Min RK	b001be2c82	check origin of API requests ... protects agains CSRF on POST endpoints via forms.	11 years ago
Min RK	e4cc3a6ea2	FileFindHandler inherits from IPythonHandler ... in order to get default CSP headers	11 years ago
Min RK	5403d2479d	make content_security_policy a property ... and *add* `default-src: 'none'` to API handlers custom CSP applies to all handlers	11 years ago
Min RK	709ed0d04b	Add APIHandler base class ... - ensures all API responses are json - sets CSP to prevent js execution on all API replies	11 years ago
Min RK	1a91f8ce74	remove clusters tab from notebook ... moving to an nbextension in ipyparallel	11 years ago
Min RK	d71a59cc9f	s/jupyter_notebook/notebook	11 years ago