Skip to content

Conversation

@emin63
Copy link

@emin63 emin63 commented Nov 3, 2025

This fixes a bug where changing the password still allowed login by a previous cookie even if the server was restarted.

See https://github.com/jupyter-server/jupyter_server/pull/1567/files#r2483108218 for original discussion.

I tested as follows:

  1. Setup a tempdir for various config/runtime directories:
    • \rm -rf /tmp/jup_temp && mkdir /tmp/jup_temp
  2. Set env vars to point config at above:
    • export JUPYTER_CONFIG_DIR=/tmp/jup_temp/conf
    • export XDG_CONFIG_HOME=/tmp/jup_temp/xdg
    • export JUPYTER_DATA_DIR=/tmp/jup_temp/data
    • export JUPYTER_RUNTIME_DIR=/tmp/jup_temp/run
  3. Set password
    • jupyter server password # type password1
  4. Start server and login with password to save cookie.
    • jupyter server
  5. Change password:
    • jupyter server password # type password2
  6. Restart server and try to login to verify that old cookie does not work and you are challenged for new password.
    • jupyter server

…#1567.

This fixes a bug where changing the password still allowed
login by a previous cookie even if the server was restarted.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant