Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Made the www-frame-origin for rserver environment-configurable #148

Merged
merged 4 commits into from
Apr 3, 2024
Merged

Made the www-frame-origin for rserver environment-configurable #148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
eaef6e3
Allowed environment configuration of RSERVER_FRAME_ORIGIN, NB_USER, R…
rickmcgeer Mar 25, 2024
af7fdba
Update README.md
rickmcgeer Mar 25, 2024
c178287
Delete .egg-info directory.
ryanlovett Apr 1, 2024
1b613d7
Use dedicated function for frame origin.
ryanlovett Apr 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,3 +40,12 @@ conda install -c conda-forge jupyter-rsession-proxy
### Multiuser Considerations

This extension launches an rstudio server process from the jupyter notebook server. This is fine in JupyterHub deployments where user servers are containerized since other users cannot connect to the rstudio server port. In non-containerized JupyterHub deployments, for example on multiuser systems running LocalSpawner or BatchSpawner, this not secure. Any user may connect to rstudio server and run arbitrary code.

## Configuration with Environment Variables
The following behavior can be configured with environment variables

| Environment Variable | Effect | Default Value | Notes
| JUPYTER_RSESSION_PROXY_WWW_FRAME_ORIGIN | The value of the `www-frame-origin` flag to rserver | `same` | |
| RSERVER_TIMEOUT | Idle timeout flag to rserver in minutes | 15 | must be numeric and positive |
| RSESSION_TIMEOUT | Idle timeout flag to rsession in minutes | 15 | must be numeric and positive |
| NB_USER | Fallback name of the Notebook user, if password database lookup fails | `getuser.getpass()` ||
10 changes: 8 additions & 2 deletions jupyter_rsession_proxy/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ def get_system_user():
try:
user = pwd.getpwuid(os.getuid())[0]
except:
user = os.environ.get('NB_USER', getpass.getuser())
user = os.getenv('NB_USER', getpass.getuser())
return(user)

def setup_rserver():
Expand Down Expand Up @@ -77,6 +77,12 @@ def _support_arg(arg):
ret = subprocess.check_output([get_rstudio_executable('rserver'), '--help'])
return ret.decode().find(arg) != -1

def _get_www_frame_origin(default="same"):
try:
return os.getenv('JUPYTER_RSESSION_PROXY_WWW_FRAME_ORIGIN', default)
except Exception:
return default

def _get_cmd(port):
ntf = tempfile.NamedTemporaryFile()

Expand All @@ -88,7 +94,7 @@ def _get_cmd(port):
cmd = [
get_rstudio_executable('rserver'),
'--auth-none=1',
'--www-frame-origin=same',
'--www-frame-origin=' + _get_www_frame_origin(),
'--www-port=' + str(port),
'--www-verify-user-agent=0',
'--secure-cookie-key-file=' + ntf.name,
Expand Down