RuntimeWarning: Expected to see HubAuthenticatedHandler

[fcollonval]

Description

We have updated to JupyterLab 3 (and jupyter_server). And we are now seeing the following warning in the logs for all api handlers when starting JupyterLab user servers (using local process spawner):

python3.7/site-packages/jupyter_server/base/handlers.py:131: RuntimeWarning: Expected to see HubAuthenticatedHandler in <class 'jupyter_server.base.handlers.FileFindHandler'>.mro()

Expected behavior

The warning is raising questions about the security of our infrastructure. Is it expected?

Context

• Operating System and version: Debian 9 (stretch)
• Jupyter Server version:
  • jupyter_client 6.1.12 pyhd8ed1ab_0 conda-forge
  • jupyter_core 4.7.1 py37h89c1867_0 conda-forge
  • jupyter_server 1.6.4 py37h89c1867_0 conda-forge
  • jupyterhub 1.4.0 py37h89c1867_0 conda-forge
  • jupyterhub-base 1.4.0 py37h89c1867_0 conda-forge
  • jupyterhub-singleuser 1.4.0 py37h89c1867_0 conda-forge
    jupyterlab 3.0.14 pyhd8ed1ab_0 conda-forge

[minrk]

Thanks for the report! I'm looking into it.

To alleviate security concerns while I do, exactly how hub auth gets patched into Jupyter Server handlers changed in a recent version of jupyterhub to be more efficient, so it patches the base handler class once on startup instead of repeatedly patching Handler instances on every request. This warning is the fallback where the one-time patch wasn't applied to a given handler, and the old way is taken instead (it is not removed to protect against exactly this eventuality), so auth should not be affected, but it will be a bit less efficient (and not any less efficient than it was a few months ago). This occurs when a handler isn't derived from the app's BaseHandler class.

I have been able to reproduce this, and it occurs if you are using NotebookApp with jupyterlab as an Extension, since the jupyterlab extension uses the jupyter_server handlers, and only the notebook base handler is patched at startup.

Short answer, if you are using juptyerlab, set:

c.Spawner.cmd = ["jupyter-labhub"]

and the warning should go away because the old NotebookApp shouldn't be used anymore, everything ought to use jupyter_server and you should be set.

The fix belongs in JupyterHub, to make sure we patch jupyter_server and notebook base handlers, because mixing the two is actually a valid thing to do, which I didn't fully realize. I'll transfer this issue to the jupyterhub repo, where the fix should reside.

I'll also update the warning to include a reassurance that auth is still applied, just at a slightly different time to avoid causing undue stress.

[minrk]

Oop, I don't seem to have permissions to transfer issues cross-org. No problem, I'll just link the PR to this issue.

[blink1073]

That's odd, I verified that you are an owner on the org.

[minrk]

From the docs:

You can only transfer issues between repositories owned by the same user or organization account. You can't transfer an issue from a private repository to a public repository.

so it apparently can't be done. I could swear I've done it before, but who knows? 🤷

Not a big deal. jupyterhub/jupyterhub#3437 should fix it.

[blink1073]

Ahh, Meeseeks can do it though: jupyter/notebook#5996 (comment)

[fcollonval]

Thanks a lot @minrk for the reassuring detailed answer.