Require token authentication for Unsloth Jupyter - #1
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The custom entrypoint explicitly disabled Jupyter authentication and allowed every origin. Generate a secure token when
JUPYTER_TOKENis unset/empty, preserve explicitly supplied tokens with safe Python quoting, and remove wildcard CORS. PinJUPYTER_CONFIG_DIRfor the supervised server. Store the config/token with owner-only permissions and document local token retrieval.Use the public login page for the health check and avoid copying Jupyter credentials into the SSH environment file. Existing network bindings remain as configured.
Validation:
python3 scripts/test_jupyter_auth.pyand Bash syntax checks passed. A local Jupyter Server 2.21.0 smoke test returned 403 for missing/incorrect tokens, 200 with the generated token, and 200 for/login. Full GPU-container startup was not run. Local Docker Compose 2.31 rejects the existinggpus: allfield on both base and patched configurations, so full Compose validation is blocked by that pre-existing compatibility issue.Addresses BRE2-1112.