Send POST request to `/hub/spawn/` from a service does not work in 4.1.2 about jupyterhub

[trungleduc]

Thank @minrk for the pointer! We adopted the new approach and it works nicely.

[trungleduc]

cc @jtpio

[trungleduc]

We inject the xsrf_token to the page via the jinja2 template

class BaseHandler(HubOAuthenticated, web.RequestHandler):
   ...
    async def render_template(self, name: str, **kwargs) -> str:
        template_ns = dict(
            ...
            xsrf_token=self.xsrf_token.decode("ascii"),

        )
        template_ns.update(kwargs)
        template = self.get_template(name)
        return template.render(**template_ns)
   ...

https://github.com/plasmabio/tljh-repo2docker/blob/master/tljh_repo2docker/base.py#L92

[minrk]

Yes, this request shouldn't work, which is fixed in 4.1. Instead, the service should request permission to spawn via OAuth scopes (service.oauth_client_allowed_scopes in config, or be given permission to spawn on behalf of users without any user intervention via role assignment to the service itself) and use the resulting token to make the launch request via the API. Using tokens to authenticate requests eliminates all xsrf issues. The request can be the same originating from the browser, but put the oauth token in the Authorization header instead of the xsrf token in the URL.

c.JupyterHub.services = [
    {
        "name": "myservice",
        "oauth_client_allowed_scopes": ["servers!user"],
        ...
    }
]