# URL Token parameter now disabled?

**URL:** <https://discourse.jupyter.org/t/url-token-parameter-now-disabled/31421>\
**Category:** Zero to JupyterHub on Kubernetes\
**Created:** [January 7, 2025, 5:25am UTC](https://discourse.jupyter.org/t/url-token-parameter-now-disabled/31421 "2025-01-07T05:25:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andrew\_Chang](https://avatars.discourse-cdn.com/v4/letter/a/f6c823/32.png) [@Andrew\_Chang](https://discourse.jupyter.org/u/Andrew_Chang)\
**Post date:** [January 7, 2025, 5:25am UTC](https://discourse.jupyter.org/t/url-token-parameter-now-disabled/31421/1 "2025-01-07T05:25:26Z")

</div>

I could have sworn I saw documentation on how using _?token=abc_ in the URL as a parameter is now blocked by OAuth and there’s a configuration to disable this. If it exists, can anyone point me to it?

Wanted to test the behavior since you’ll need to login/authenticate via the browser even after adding the token param into the URL. It may also be affecting websocket authentication for me.

---

<div class="post-metadata">

**Author:** ![manics](https://yyz1.discourse-cdn.com/flex031/user_avatar/discourse.jupyter.org/manics/32/85_2.png) [@manics](https://discourse.jupyter.org/u/manics)\
**Post date:** [January 7, 2025, 10:42am UTC](https://discourse.jupyter.org/t/url-token-parameter-now-disabled/31421/2 "2025-01-07T10:42:57Z")

</div>

There was a bug in some older versions of JupyterHub/Z2JH:

> [@Websocket http error 403](https://discourse.jupyter.org/t/websocket-http-error-403/21141/8):
>
> I’ve tracked it down to a bug in the new JupyterHub singleuser-server extension. If you set the JUPYTERHUB\_SINGLEUSER\_EXTENSION=0 environment variable in your single-user environments (e.g. c.Spawner.environment), then I think this will work. update: [patch fixing the bug](https://github.com/jupyterhub/jupyterhub/pull/4560)

Which version are you using?

---

<div class="post-metadata">

**Author:** ![Andrew\_Chang](https://avatars.discourse-cdn.com/v4/letter/a/f6c823/32.png) [@Andrew\_Chang](https://discourse.jupyter.org/u/Andrew_Chang)\
**Post date:** [January 7, 2025, 1:01pm UTC](https://discourse.jupyter.org/t/url-token-parameter-now-disabled/31421/3 "2025-01-07T13:01:11Z")

</div>

Oh interesting.

**JupyterHub Helm Chart** : v4.0.1-0.dev.git.6874.h2390243c  
**JupyterHub** : v5.2.1

Added the `JUPYTERHUB_SINGLEUSER_EXTENSION=0` env var to our custom KubeSpawner environments, but behavior didn’t change.

Hitting this URL with the token param in incognito browser used to authenticate correctly, but now it redirects to our Auth0 login page:  
[https://jh-server.com/user/andrew@example.com/test-server/lab?token=abc](https://jh-server.com/user/andrew@example.com/test-server/lab?token=abc)

Also seems like server side Node **WebSocket** has authentication issues whereas client side **WebSocket** seems to work fine. I’m assuming cookies/xsrf may be involved.

```auto
# Example error log on single user server when attempting to connect via WebSocket.
Couldn't authenticate WebSocket connection                                                                                                                                                 
notebook [I 2025-01-07 12:58:21.289 ServerApp] Setting new xsrf cookie for b':bDamMN8DPtF33En-AnhilPG=' {'path': '/user/andrew@example.com/test-server/', 'max_age': 3600} 

```

---

<div class="post-metadata">

**Author:** ![Andrew\_Chang](https://avatars.discourse-cdn.com/v4/letter/a/f6c823/32.png) [@Andrew\_Chang](https://discourse.jupyter.org/u/Andrew_Chang)\
**Post date:** [January 7, 2025, 2:59pm UTC](https://discourse.jupyter.org/t/url-token-parameter-now-disabled/31421/4 "2025-01-07T14:59:52Z")

</div>

Found the doc! [Upgrading to JupyterHub 5 — JupyterHub documentation](https://jupyterhub.readthedocs.io/en/5.2.1/howto/upgrading-v5.html#tokens-in-urls)

The env var `JUPYTERHUB_ALLOW_TOKEN_IN_URL` specified actually fixed our issues here. Seems like the default behavior is messing with some authentication processes that aren’t browser based.