From dd2214ddde238b46105ffefe466829d4a6a6de66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Collonval?= <fcollonval@gmail.com>
Date: Sat, 2 May 2020 10:34:25 +0200
Subject: [PATCH 1/2] Add `authenticated` decorator to handlers in doc

---
 docs/source/developers/extensions.rst | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docs/source/developers/extensions.rst b/docs/source/developers/extensions.rst
index 2404ebf68f..4105ac682c 100644
--- a/docs/source/developers/extensions.rst
+++ b/docs/source/developers/extensions.rst
@@ -27,12 +27,15 @@ The easiest way to add endpoints and handle incoming requests is to subclass the
 .. code-block:: python
 
     from jupyter_server.base.handlers import JupyterHandler
+    import tornado
 
     class MyExtensionHandler(JupyterHandler):
 
+        @tornado.web.authenticated
         def get(self):
             ...
 
+        @tornado.web.authenticated
         def post(self):
             ...
 
@@ -178,13 +181,16 @@ Jupyter Server provides a convenient mixin class for adding these properties to
 
     from jupyter_server.base.handlers import JupyterHandler
     from jupyter_server.extension.handler import ExtensionHandlerMixin
+    import tornado
 
 
     class MyExtensionHandler(ExtensionHandlerMixin, JupyterHandler):
 
+        @tornado.web.authenticated
         def get(self):
             ...
 
+        @tornado.web.authenticated
         def post(self):
             ...
 
@@ -217,6 +223,7 @@ Pair the example above with ``ExtensionHandlers`` that also inherit the ``Extens
         ExtensionHandlerMixin,
         ExtensionHandlerJinjaMixin
     )
+    import tornado
 
     class MyExtensionHandler(
         ExtensionHandlerMixin,
@@ -224,9 +231,11 @@ Pair the example above with ``ExtensionHandlers`` that also inherit the ``Extens
         JupyterHandler
     ):
 
+        @tornado.web.authenticated
         def get(self):
             ...
 
+        @tornado.web.authenticated
         def post(self):
             ...
 

From 48feaee30ad524cd2b5b2e4a878d08621c89c3fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Collonval?= <fcollonval@gmail.com>
Date: Tue, 5 May 2020 19:46:20 +0200
Subject: [PATCH 2/2] Add note on the `authenticated` decorator

---
 docs/source/developers/extensions.rst | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/source/developers/extensions.rst b/docs/source/developers/extensions.rst
index 4105ac682c..7e41e4716b 100644
--- a/docs/source/developers/extensions.rst
+++ b/docs/source/developers/extensions.rst
@@ -39,6 +39,8 @@ The easiest way to add endpoints and handle incoming requests is to subclass the
         def post(self):
             ...
 
+.. note::
+   It is best practice to wrap each handler method with the ``authenticated`` decorator to ensure that each request is authenticated by the server.
 
 Then add this handler to Jupyter Server's Web Application through the ``_load_jupyter_server_extension`` function.