Login page cookie expires after 60 minutes

JupyterHub
1

JupyterHub Version: 5.2.1
Helm Chart: 4.0.0

We frequently use JupyterHub in rooms with multiple PCs, where we pre-start the machines so that they display the login page (e.g. for exams).

We’ve noticed that if the login page remains open for more than 60 minutes before logging in, users encounter the following error after attempting to log in:

403 Forbidden: XSRF cookie does not match POST argument

Upon inspecting the cookies, we found that the max age for the cookie set on the login page is 60 minutes (3,600 seconds). Refreshing the page does not return users to the login screen; instead, it simply refreshes the error message. In an exam setting, this can cause confusion and anxiety, as students may think something has gone seriously wrong.

Is there a way to increase the max age of the cookie set on the login page or another workaround? We prefer to have the login page open at boot, as it serves as a simple confirmation that the hub is accessible and functioning properly.

2

I never imagined the login page being open for more than a few minutes! The error should definitely be better than that.

It is not currently possible to override the expiration of anonymous xsrf tokens (the ones used by the login page), which is hardcoded here.

The simplest workaround might be to reload the login page while it’s idle with a custom login.html page template:

{% extends "templates/login.html" %}

{% block script %}
{{ super() }}
<script type="text/javascript">
  // reload login page every 10 minutes
  // to avoid expiration of form tokens
  setTimeout(() => {
    console.log("reloading");
    location.reload();
  }, 10 * 60 * 1000);
</script>
{% endblock script %}

With that, there may still be up to 10 minutes in an hour where the xsrf token has expired, because loading the login page doesn’t always set a new xsrf token unless the current one has expired. That should be fixed.

I’ll work on improving the behavior for expired tokens and keeping them alive.

2 Likes
3

Thank you for your quick reply.
I suspected the cookie was hardcoded. We will try the workaround with the refresh or maybe put another page in front of that for now.

4

improve xsrf errors on login by minrk · Pull Request #5022 · jupyterhub/jupyterhub · GitHub is my attempt to improve this. It doesn’t actually increase the expiration, but should greatly improve the experience of login failing due to this expiration, and make it less likely. It also means that above refresh strategy will actually guarantee a valid token because a fresh token is always set when the login page is served.

1 Like