{"action":"created","issue":{"url":"https://api.github.com/repos/jupyter/jupyterhub/issues/507","repository_url":"https://api.github.com/repos/jupyter/jupyterhub","labels_url":"https://api.github.com/repos/jupyter/jupyterhub/issues/507/labels{/name}","comments_url":"https://api.github.com/repos/jupyter/jupyterhub/issues/507/comments","events_url":"https://api.github.com/repos/jupyter/jupyterhub/issues/507/events","html_url":"https://github.com/jupyter/jupyterhub/issues/507","id":147872808,"number":507,"title":"JupyterHub does not ask for authentication once you have created a notebook server for a user ","user":{"login":"pawannrao-ebay","id":16504766,"avatar_url":"https://avatars.githubusercontent.com/u/16504766?v=3","gravatar_id":"","url":"https://api.github.com/users/pawannrao-ebay","html_url":"https://github.com/pawannrao-ebay","followers_url":"https://api.github.com/users/pawannrao-ebay/followers","following_url":"https://api.github.com/users/pawannrao-ebay/following{/other_user}","gists_url":"https://api.github.com/users/pawannrao-ebay/gists{/gist_id}","starred_url":"https://api.github.com/users/pawannrao-ebay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pawannrao-ebay/subscriptions","organizations_url":"https://api.github.com/users/pawannrao-ebay/orgs","repos_url":"https://api.github.com/users/pawannrao-ebay/repos","events_url":"https://api.github.com/users/pawannrao-ebay/events{/privacy}","received_events_url":"https://api.github.com/users/pawannrao-ebay/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2016-04-12T21:07:09Z","updated_at":"2016-04-15T19:39:57Z","closed_at":null,"body":"For the purpose of discussion lets say JupyterHub running in this URL:\r\n\r\nhttp://10.x.y.z:8080\r\n\r\nFor first time login, the chrome browser would show the login page and set cookie for the active user once login is completed.\r\n\r\nAt jupyterhub end if there is no Notebook server for that user, it would create an entry in the database and call Spawner to create new Notebook server.\r\n\r\nThe next time you hit the site it would send 302 redirect to user specific URL, for example:\r\nhttp://10.x.y.z:8080/user/userx/notebooks/Demo-Spark.ipynb\r\n\r\nNow if you delete the cookies associated with jupyterhub, the hub-token and the user token but start use the notebook server url directly no authentication is seeked for. Once the Notebook server is created, hitting directly to that URL (http://10.x.y.z:8080/user/userx/notebooks/Demo-Spark.ipynb) from browser with no cookie does not redirect back to login page. This is insecure and unexpected.\r\n\r\n*IMPORTANT* : This happens when notebookserver is running remotely, if the notebook server is running locally this is not seen. So you need to use some remote spawners available out there to try this out and not with LocalSpawner."},"comment":{"url":"https://api.github.com/repos/jupyter/jupyterhub/issues/comments/210611478","html_url":"https://github.com/jupyter/jupyterhub/issues/507#issuecomment-210611478","issue_url":"https://api.github.com/repos/jupyter/jupyterhub/issues/507","id":210611478,"user":{"login":"minrk","id":151929,"avatar_url":"https://avatars.githubusercontent.com/u/151929?v=3","gravatar_id":"","url":"https://api.github.com/users/minrk","html_url":"https://github.com/minrk","followers_url":"https://api.github.com/users/minrk/followers","following_url":"https://api.github.com/users/minrk/following{/other_user}","gists_url":"https://api.github.com/users/minrk/gists{/gist_id}","starred_url":"https://api.github.com/users/minrk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/minrk/subscriptions","organizations_url":"https://api.github.com/users/minrk/orgs","repos_url":"https://api.github.com/users/minrk/repos","events_url":"https://api.github.com/users/minrk/events{/privacy}","received_events_url":"https://api.github.com/users/minrk/received_events","type":"User","site_admin":false},"created_at":"2016-04-15T19:39:57Z","updated_at":"2016-04-15T19:39:57Z","body":"How did you delete the cookies? Single-user cookies are set on a different path from the Hub cookie, so you will probably want to be looking at a single-user page when you go to the cookie-edit dialog. The easier way to clear this cookie is to click the logout button (clearing these cookies is all logout does)."}}