[BUG] Static paths loaded always from localhost in Bokeh 3.1.1

[salmituukka]

Software versions

Python version : 3.11.3 (tags/v3.11.3:f3909b8, Apr 4 2023, 23:49:59) [MSC v.1934 64 bit (AMD64)]
IPython version : (not installed)
Tornado version : 6.3.2
Bokeh version : 3.1.1
BokehJS static path : C:\bokeh-error\venv\Lib\site-packages\bokeh\server\static
node.js version : v16.14.2
npm version : 8.5.0
Operating system : Windows-10-10.0.19044-SP0

Browser name and version

No response

Jupyter notebook / Jupyter Lab version

No response

Expected behavior

When running bokeh server on remote server it is expected that browser would try to load static paths from the server, not from the localhost. However, it seems that it always tries to load static paths from the localhost with Bokeh 3.1.1 while Bokeh 3.1.0 works well.

This can be demonstrated from local machine as well by the following steps:

1. Minimal code
2. Run bokeh serve bokeh-error --port 5006 --allow-websocket-origin [IP_ADDRESS]:5006
3. Open browser [IP_ADDRESS]:5006/bokeh-error

Observed behavior

Static paths are loaded from localhost instead of actual IP_ADDRESS

Example code

from bokeh.plotting import curdoc
from bokeh.models import Button

button = Button(label="Press Me")
curdoc().add_root(button)

Stack traceback or browser console output

No response

Screenshots

[mattpap]

This is a side effect of PR #13041.

[albertosottile]

+1, I currently did not find a way to deploy a Dockerfile based on docker serve on a standalone server. All static URLs point to http://localhost:5006/static/ or to whatever I pass to --address. There is currently no way to configure a standalone server on bokeh==3.11.1

[bryevdv]

@albertosottile unless you are in an air-gapped situation, I'd recommend setting the environment variable BOKEH_RESOURCES=cdn and then the app will load BokehJS from cdn.bokeh.org rather than the Bokeh server itself. I'd recommend this a best practice in any real situation FWIW, and it may become the default in the future.

[aronatkins]

We have also seen that 3.1.1 breaks proxied serving of Bokeh applications. Previously, with the 3.1.0 release, relative URLs were used for the various Bokeh resources. These relative references were successfully resolved when the Bokeh application was hosted behind a proxy server (rewriting the protocol, the host, the port, and the path).

Here is a simple Dockerfile to help recreate the problem:

FROM python:3.11

ARG BOKEH_VERSION=3.1.1
RUN pip install bokeh==${BOKEH_VERSION}

COPY sliders.py /content/sliders.py
WORKDIR /content

You can build then run with:

docker build --build-arg BOKEH_VERSION=3.1.1 -t bokeh-test .
docker run -it --rm -p 5007:5006 bokeh-test bokeh serve --allow-websocket-origin='*' --show sliders.py

Visit the hosted application at http://localhost:5007/sliders and observe that absolute references to http://localhost:5006 are included in the returned content.

Use BOKEH_VERSION=3.1.0 to repeat this experiment with the previous release and observe that the application is correctly served, containing relative URLs.

@bryevdv & @mattpap - Are you indicating that this is an intentional regression in the 3.1.1 patch release? That is not obvious from the https://github.com/bokeh/bokeh/blob/branch-3.1/docs/CHANGELOG

(also, minor point: the 3.1.1 notes aren't available on the branch-3.2 or main versions of the CHANGELOG)

[bryevdv]

@aronatkins this issue has been labeled as a bug.

the 3.1.1 notes aren't available on the branch-3.2

Forward porting of changelogs to newer branches is still manual, so it currently happens whenever someone gets to it. Someone helping to automate this would be appreciated.

[aronatkins]

@aronatkins this issue has been labeled as a bug.

Thanks @bryevdv. It wasn't clear that folks were treating this as a regression. The suggestion to use CDN-hosted assets felt like it was given as a long-term solution rather than a temporary workaround.

I apologize for my initial misinterpretation.

[bryevdv]

Adding CRITICAL to make sure this does not slip though, it's come up 3-4 more times in the last few days alone. Once fixed I'll probably also make a backport and a 3.2.3 release so that there is one 3.2.x version that works into the future.