# Is it possible to avoid exposing token in GET parameter in JupyterHub

**URL:** <https://discourse.jupyter.org/t/is-it-possible-to-avoid-exposing-token-in-get-parameter-in-jupyterhub/24367>\
**Category:** JupyterHub\
**Tags:** jupyterhub, how-to, help-wanted\
**Created:** [March 8, 2024, 4:21am UTC](https://discourse.jupyter.org/t/is-it-possible-to-avoid-exposing-token-in-get-parameter-in-jupyterhub/24367 "2024-03-08T04:21:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![huangjunwen](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/huangjunwen/32/12648_2.png) [@huangjunwen](https://discourse.jupyter.org/u/huangjunwen)\
**Post date:** [March 8, 2024, 4:21am UTC](https://discourse.jupyter.org/t/is-it-possible-to-avoid-exposing-token-in-get-parameter-in-jupyterhub/24367/1 "2024-03-08T04:21:13Z")

</div>

Hi everyone,

We’re deploying JupyterHub in our organization, one of the requirement is to pass a penetration testing. The testing has one finding: **Sensitive information passed as GET parameter** , and we don’t have a clue how to fix

To reproduce the issue, just trying to visit some non-existent page: `/user/<user_id>/notexists`, then the return page will contains some link with ‘token’ parameter like `/user/<user_id>/lab?token=xxxxx`:

 ![token_exposed](https://canada1.discourse-cdn.com/flex031/uploads/jupyter/original/2X/7/76af06a94ff618f86ae84fbb306fdbbb81094d8c.png)

After some searching I believe this is documented here: [Security in the Jupyter Server — Jupyter Server documentation](https://jupyter-server.readthedocs.io/en/latest/operators/security.html) , seems the token is used to authenticate the underlie jupyter-server?

We’re using SAML to authenticate user in the hub. So I want to know more about the process after authentication and how the token got generated and passed around between the components (e.g. the hub, the single user server). And most importantly, is it possible to avoid exposing the token in URL?

Could someone help me pls, thanks in advanced.

---

<div class="post-metadata">

**Author:** ![minrk](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/minrk/32/13_2.png) [@minrk](https://discourse.jupyter.org/u/minrk)\
**Post date:** [March 14, 2024, 9:54am UTC](https://discourse.jupyter.org/t/is-it-possible-to-avoid-exposing-token-in-get-parameter-in-jupyterhub/24367/2 "2024-03-14T09:54:56Z")

</div>

The token probably shouldn’t be there in that link. A custom template can be used to remove it, but it’s not in a small overrideable block, so you would have to override the whole `page.html` template, which you can do. Removed [here](https://github.com/jupyter-server/jupyter_server/pull/1406).

> [@huangjunwen](#):
>
> So I want to know more about the process after authentication and how the token got generated

In JupyterHub, this token is issued when the user visits the server after successful authentication via oauth, and stored (encrypted) in a cookie. The token you see on the page is the token stored in the same browser’s cookie, and different for any visitor to the sever. It is the token with which JupyterLab authenticates all API requests, typically via the `Authorization: Bearer <token>` header. More information on JupyterHub’s oauth tokens [in the docs](https://jupyterhub.readthedocs.io/en/latest/explanation/oauth.html).

---

<div class="post-metadata">

**Author:** ![huangjunwen](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/huangjunwen/32/12648_2.png) [@huangjunwen](https://discourse.jupyter.org/u/huangjunwen)\
**Post date:** [March 15, 2024, 1:19am UTC](https://discourse.jupyter.org/t/is-it-possible-to-avoid-exposing-token-in-get-parameter-in-jupyterhub/24367/3 "2024-03-15T01:19:10Z")

</div>

@minrk Thank you so much. Let me check.