Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

README: warn about unlimited local network access #359

Merged
merged 3 commits into from
Dec 15, 2022
Merged

README: warn about unlimited local network access #359

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a0fc561
README: warn about unlimited local network access
manics Nov 19, 2022
6df5c7f
Expand README warning
manics Dec 14, 2022
ac76d02
Remove mention of unix socket since it's an open PR.
manics Dec 14, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,24 @@ The primary use cases are:
[The documentation](https://jupyter-server-proxy.readthedocs.io/)
contains information on installation & usage.

## Security warning

Jupyter Server Proxy is often used to start a user defined process listening to
some network port (e.g. http://localhost:4567) for a user starting a Jupyter Server
that only that user has permission to access. The user can then access the
started process proxied through the Jupyter Server.

For safe use of Jupyter Server Proxy, you should ensure that the process started
by Jupyter Server proxy can't be accessed directly by another user and bypass
the Jupyter Server's authorization!

A common strategy to enforce access proxied via Jupyter Server is to start
Jupyter Server within a container and only allow network access to the Jupyter
Server via the container.

For more insights, see [Ryan Lovetts comment about
it](https://github.com/jupyterhub/jupyter-server-proxy/pull/359#issuecomment-1350118197).

## Install

### Requirements
Expand Down