Web server startup code

[mardy]

Hi there!
We got a bug report in snapd, about an error occurring with the user tries to open the URL

        file:///home/<user>/.local/share/jupyter/runtime/nbserver-45601-open.html

with the browser (which, if packages as a snap, does not have access to ~/.local/). I wanted to propose a merge request to jupiter-notebook about changing the ordering of the text printed by the jupiter web server, that is from

    To access the notebook, open this file in a browser:
        file:///home/j/.local/share/jupyter/runtime/nbserver-45601-open.html
    Or copy and paste one of these URLs:
        http://localhost:8888/?token=6df6a314b44a50e058ff27f735d91cbd46bfaf0e403bd2e9
     or http://127.0.0.1:8888/?token=6df6a314b44a50e058ff27f735d91cbd46bfaf0e403bd2e9

to something like

    To access the notebook, open one of these URLs in a browser:
        http://localhost:8888/?token=6df6a314b44a50e058ff27f735d91cbd46bfaf0e403bd2e9
     or http://127.0.0.1:8888/?token=6df6a314b44a50e058ff27f735d91cbd46bfaf0e403bd2e9
    The server files are located in your filesystem at:
        /home/j/.local/share/jupyter/runtime/nbserver-45601-open.html

so that the user would preferably open the URLs via the web server (because that would work). But I cannot find where's the source code of this server. I see that it has been removed with #6294, but it's not clear to me if it has been replaced with something else, and if there still is such a text somewhere, inviting the user to open file:///home/<user>/.local/... with the browser.

Can you please point me at the right direction?

[owainkenwayucl]

So as the person sort of responsible for opening the issue that caused this feature (as implemented in this pull request: #4260) this is itself a security feature because due to the multiple paths Jupyter takes to authenticate a browser, running [browser] http://localhost:[port}/?token=... exposes the token to other users of a multi-user system and allows them to race the legitimate user of the session to undetectably connect (see #4260)

It's worse in a snap environment because the snap browser loads so slowly dramatically increasing the success chance for attackers.