From faf60320dda6f08cbb2db5b4b8754de812ce6580 Mon Sep 17 00:00:00 2001
From: Min RK <benjaminrk@gmail.com>
Date: Mon, 19 Dec 2016 15:02:36 +0100
Subject: [PATCH 1/4] Further highlight token info in log output

add critical-level log statement at the end of startup with token info
---
 notebook/notebookapp.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/notebook/notebookapp.py b/notebook/notebookapp.py
index 783737b5af..39962634d0 100755
--- a/notebook/notebookapp.py
+++ b/notebook/notebookapp.py
@@ -1321,7 +1321,15 @@ def start(self):
                 b = lambda : browser.open(url_path_join(self.connection_url, uri),
                                           new=2)
                 threading.Thread(target=b).start()
-        
+
+        if self.token:
+            self.log.critical('\n'.join([
+                '\n',
+                'Copy/paste this URL into your browser when you connect for the first time,',
+                'to login with a token:',
+                '    %s' % url_concat(self.connection_url, {'token': self.token}),
+            ]))
+
         self.io_loop = ioloop.IOLoop.current()
         if sys.platform.startswith('win'):
             # add no-op to wake every 5s

From 65cb6cc1859e545404dcac347d6bfcd2947b6295 Mon Sep 17 00:00:00 2001
From: Min RK <benjaminrk@gmail.com>
Date: Tue, 20 Dec 2016 15:28:16 +0100
Subject: [PATCH 2/4] Only show token info if tokens are available

on login page
---
 notebook/templates/login.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/notebook/templates/login.html b/notebook/templates/login.html
index 1cf0a3fad1..19a38418c8 100644
--- a/notebook/templates/login.html
+++ b/notebook/templates/login.html
@@ -20,7 +20,7 @@
       <div class="navbar-inner">
         <div class="container">
           <div class="center-nav">
-            <p class="navbar-text nav">Password or token:</p>
+            <p class="navbar-text nav">Password{% if token_available %} or token{% endif %}:</p>
             <form action="{{base_url}}login?next={{next}}" method="post" class="navbar-form pull-left">
               <input type="password" name="password" id="password_input" class="form-control">
               <button type="submit" id="login_submit">Log in</button>
@@ -42,10 +42,11 @@
       {% endfor %}
       </div>
     {% endif %}
+    {% if token_available %}
     {% block token_message %}
     <div class="col-sm-6 col-sm-offset-3 text-left">
       <p class="warning">
-        If this notebook server has no password set, token authentication is enabled.
+        Token authentication is enabled.
 
         You need to open the notebook server with its first-time login token in the URL,
         or enable a password in order to gain access.
@@ -64,6 +65,7 @@
       </p>
     </div>
     {% endblock token_message %}
+    {% endif %}
 </div>
 
 {% endblock %}

From 376052578334632444af0341e9c38bc71432e41f Mon Sep 17 00:00:00 2001
From: Min RK <benjaminrk@gmail.com>
Date: Tue, 20 Dec 2016 15:35:38 +0100
Subject: [PATCH 3/4] Only log generated tokens in URLs

if token came from config, assume user knows what it is
or it's handled some other way.
---
 notebook/notebookapp.py | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/notebook/notebookapp.py b/notebook/notebookapp.py
index 39962634d0..8f9341954f 100755
--- a/notebook/notebookapp.py
+++ b/notebook/notebookapp.py
@@ -593,14 +593,22 @@ def _write_cookie_secret_file(self, secret):
         """
     )
 
+    _token_generated = True
+
     @default('token')
     def _token_default(self):
         if self.password:
             # no token if password is enabled
+            self._token_generated = False
             return u''
         else:
+            self._token_generated = True
             return binascii.hexlify(os.urandom(24)).decode('ascii')
 
+    @observe('token')
+    def _token_changed(self, change):
+        self._token_generated = False
+
     password = Unicode(u'', config=True,
                       help="""Hashed password to use for web authentication.
 
@@ -1092,8 +1100,12 @@ def init_webapp(self):
     @property
     def display_url(self):
         ip = self.ip if self.ip else '[all ip addresses on your system]'
-        query = '?token=%s' % self.token if self.token else ''
-        return self._url(ip) + query
+        url = self._url(ip)
+        if self.token:
+            # Don't log full token if it came from config
+            token = self.token if self._token_generated else '...'
+            url = url_concat(url, {'token': token})
+        return url
 
     @property
     def connection_url(self):
@@ -1322,7 +1334,9 @@ def start(self):
                                           new=2)
                 threading.Thread(target=b).start()
 
-        if self.token:
+        if self.token and self._token_generated:
+            # log full URL with generated token, so there's a copy/pasteable link
+            # with auth info.
             self.log.critical('\n'.join([
                 '\n',
                 'Copy/paste this URL into your browser when you connect for the first time,',

From cbeec7ae9ae50bbfa67fa62222e3f0362c636148 Mon Sep 17 00:00:00 2001
From: Min RK <benjaminrk@gmail.com>
Date: Tue, 20 Dec 2016 15:36:46 +0100
Subject: [PATCH 4/4] Add note about cookie requirement

---
 notebook/templates/login.html | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/notebook/templates/login.html b/notebook/templates/login.html
index 19a38418c8..df394db32c 100644
--- a/notebook/templates/login.html
+++ b/notebook/templates/login.html
@@ -63,6 +63,9 @@
       <p>
         Or you can paste just the token value into the password field on this page.
       </p>
+      <p>
+        Cookies are required for authenticated access to notebooks.
+      </p>
     </div>
     {% endblock token_message %}
     {% endif %}