    def _persist_url_token_if_set(self, handler):
        """Persist ?token=... from URL in cookie if set

        for use in future cookie-authenticated requests.

        Allows initiating an authenticated session
        via /user/name/?token=abc...,
        otherwise only the initial request will be authenticated.

        No-op if no token URL parameter is given.
        """
        url_token = handler.get_argument('token', '')
        if not url_token:
            # no token to persist
            return
        # only do this if the token in the URL is the source of authentication
        if not getattr(handler, '_token_authenticated', False):
            return
        if not hasattr(self, 'set_cookie'):
            # only HubOAuth can persist cookies
            return
        fetch_mode = handler.request.headers.get("Sec-Fetch-Mode", "navigate")
        if isinstance(handler, WebSocketHandler) or fetch_mode != "navigate":
            # don't do this on websockets or non-navigate requests
            return
        self.log.info(
            "Storing token from url in cookie for %s",
            handler.request.remote_ip,
        )
        self.set_cookie(handler, url_token)
Persist ?token=... from URL in cookie if set

for use in future cookie-authenticated requests.

Allows initiating an authenticated session
via /user/name/?token=abc...,
otherwise only the initial request will be authenticated.

No-op if no token URL parameter is given.
jupyterhub/services/auth.py