monkeyking

History

Kyle Kelley ab791441b2 Backport PR #1938 : don't check origin on token-authenticated requests adds LoginHandler.should_check_origin classmethod API While testing, I noticed that we were checking origin and authentication on CSP violation reports, but browsers are sending CSP reports with no Origin, meaning that no CSP report will ever be accepted. That doesn't make sense to me, so I disabled both - a CSP report can now be made from anywhere (no auth, no check). rgbkrk does that sound right to you? Or should it be authenticated but no origin check? Signed-off-by: Min RK <benjaminrk@gmail.com>	9 years ago
..
__init__.py	s/jupyter_notebook/notebook	11 years ago
handlers.py	Backport PR #1938 : don't check origin on token-authenticated requests	9 years ago

Kyle Kelley ab791441b2 Backport PR #1938 : don't check origin on token-authenticated requests

adds LoginHandler.should_check_origin classmethod API

While testing, I noticed that we were checking origin and authentication on CSP violation reports, but browsers are sending CSP reports with no Origin, meaning that no CSP report will ever be accepted. That doesn't make sense to me, so I disabled both - a CSP report can now be made from *anywhere* (no auth, no check).  rgbkrk does that sound right to you? Or should it be authenticated but no origin check?

Signed-off-by: Min RK <benjaminrk@gmail.com>

__init__.py

s/jupyter_notebook/notebook

handlers.py

Backport PR #1938 : don't check origin on token-authenticated requests