monkeyking

Author	SHA1	Message	Date
Kyle Kelley	ab791441b2	Backport PR #1938 : don't check origin on token-authenticated requests adds LoginHandler.should_check_origin classmethod API While testing, I noticed that we were checking origin and authentication on CSP violation reports, but browsers are sending CSP reports with no Origin, meaning that no CSP report will ever be accepted. That doesn't make sense to me, so I disabled both - a CSP report can now be made from anywhere (no auth, no check). rgbkrk does that sound right to you? Or should it be authenticated but no origin check? Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
Thomas Kluyver	bffc23b704	Backport PR #1904 : json_errors should be outermost decorator on API handlers in order to apply to 403 raised by web.authenticated	9 years ago
Min RK	709ed0d04b	Add APIHandler base class - ensures all API responses are json - sets CSP to prevent js execution on all API replies	11 years ago
Min RK	d71a59cc9f	s/jupyter_notebook/notebook	11 years ago