Catch errors attempting to access document.cookie

[minrk]

behave as if cookie is empty if cookie cannot be read for sandbox reasons.

Attempting to access document.cookie can raise SecurityError if page is served with Content-Security-Policy: sandbox. Because this is accessed unconditionally, ~any page with JupyterLab js served with CSP sandbox crashes when attempting to build URLs instead of behaving as if xsrf token is unknown.

References

CSP: sandbox

Code changes

If accessing document.cookie throws an error, behave as if cookie is empty, rather than error.

User-facing changes

Loading JupyterLab javascript should no longer crash when loaded in a page with CSP: Sandbox. XSRF token will be unavailable, but is not required.

Backwards-incompatible changes

None

[jupyterlab-probot]

Thanks for making a pull request to jupyterlab!
To try out this branch on binder, follow this link:

[minrk]

it would also be a reasonable spec to let this raise here and catch where getCookie is called. I think it is called in exactly one place, to get the xsrf token.

[krassowski]

Thank you @minrk, it looks good to me.

I opened #15792 to track adding an end-to-end test as it does not seem easy to unit test in jest (nor would we cover all conditions with a unit test here).