From cc01e326a74aeb2117a19a9fb112fa4d3a1911a7 Mon Sep 17 00:00:00 2001
From: stevejpurves <steve@curvenote.com>
Date: Tue, 21 Nov 2023 22:37:06 +0000
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=9B=A0fix=20wsUrl=20bug=20&=20?=
 =?UTF-8?q?=F0=9F=A4=96=20randomize=20default=20token?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packages/core/src/options.ts | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/packages/core/src/options.ts b/packages/core/src/options.ts
index 29f107a0..7661267e 100644
--- a/packages/core/src/options.ts
+++ b/packages/core/src/options.ts
@@ -8,6 +8,7 @@ import type {
   SavedSessionOptions,
   MathjaxOptions,
 } from './types';
+import { shortId } from './utils';
 
 export function makeBinderOptions(opts: BinderOptions) {
   return {
@@ -36,12 +37,15 @@ export function makeKernelOptions(opts: KernelOptions): Required<KernelOptions>
 }
 
 export function makeServerSettings(settings: ServerSettings): Required<ServerSettings> {
+  const baseUrl = settings.baseUrl ?? 'http://localhost:8888';
+  const wsUrl = settings.wsUrl ?? baseUrl.replace(/^http/, 'ws');
+
   return {
-    baseUrl: 'http://localhost:8888',
-    token: 'test-secret',
+    token: shortId(), // randomized default token to prevent accidental access to a local server
     appendToken: true,
-    wsUrl: 'ws://localhost:8888',
     ...settings,
+    wsUrl,
+    baseUrl,
   };
 }
 

From 50b8123511b99fa5e13cc0be7e9f477264d7b0b9 Mon Sep 17 00:00:00 2001
From: stevejpurves <steve@curvenote.com>
Date: Tue, 21 Nov 2023 23:13:24 +0000
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=92=9A=20tests?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 packages/core/tests/config.spec.ts  | 14 ++++++++------
 packages/core/tests/options.spec.ts | 14 ++++++++------
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/packages/core/tests/config.spec.ts b/packages/core/tests/config.spec.ts
index 864eb689..36151556 100644
--- a/packages/core/tests/config.spec.ts
+++ b/packages/core/tests/config.spec.ts
@@ -36,12 +36,14 @@ describe('config', () => {
       });
     });
     test('server settings', () => {
-      expect(config.serverSettings).toEqual({
-        baseUrl: 'http://localhost:8888',
-        token: 'test-secret',
-        appendToken: true,
-        wsUrl: 'ws://localhost:8888',
-      });
+      expect(config.serverSettings).toEqual(
+        expect.objectContaining({
+          baseUrl: 'http://localhost:8888',
+          token: expect.any(String),
+          appendToken: true,
+          wsUrl: 'ws://localhost:8888',
+        }),
+      );
     });
   });
 });
diff --git a/packages/core/tests/options.spec.ts b/packages/core/tests/options.spec.ts
index 9095c90e..0f9a9cee 100644
--- a/packages/core/tests/options.spec.ts
+++ b/packages/core/tests/options.spec.ts
@@ -87,12 +87,14 @@ describe('options', () => {
   });
   describe('server settings', () => {
     test('defaults', () => {
-      expect(makeServerSettings({})).toEqual({
-        baseUrl: 'http://localhost:8888',
-        token: 'test-secret',
-        appendToken: true,
-        wsUrl: 'ws://localhost:8888',
-      });
+      expect(makeServerSettings({})).toEqual(
+        expect.objectContaining({
+          baseUrl: 'http://localhost:8888',
+          token: expect.any(String),
+          appendToken: true,
+          wsUrl: 'ws://localhost:8888',
+        }),
+      );
     });
     test('overrides', () => {
       expect(