Auth redirects for service when making request from JS

JupyterHub
,
5

If you want to allow cross-service requests to be authenticated with cookies, you’ll need to modify or disable the XSRF check. There are two ways:

  1. set disable_check_xsrf=True in the tornado settings of your application. This will allow cross-site requests to your service (probably fine for announcements, but consider what’s in them)
  2. define check_xsrf_cookie in your Handler class, to rely on another check that accepts requests from your whole site:
class MyHandler(HubOAuthenticated, web.RequestHandler):
    def check_xsrf_cookie(self):
        # replace xsrf token with Sec-Fetch requirement
        sec_fetch_site = self.headers.get("Sec-Fetch-Site", "unspecified")
        if sec_fetch_site != "same-origin":
            raise web.HTTPError(403, f"rejecting cross-origin request from: {sec_fetch_site}")
1 Like