[Feature Request] Define an allow_headers parameter in NotebookApp similar to Kernel gateway app.

[SimonBiggs]

The KernelGatewayApp class has a parameter called allow_headers. When trying to communicate to the server to achieve kernel tasks from another origin both allow_origin and allow_headers parameters need to be used as so:

jupyter kernelgateway --KernelGatewayApp.allow_origin='http://localhost:5000' --KernelGatewayApp.allow_headers='X-XSRFToken,Content-Type' --JupyterWebsocketPersonality.list_kernels=True

I have not been able to access kernel creation from another origin when using the NotebookApp. I retrieve errors that the headers X-XSRFToken are not allowed.

I'm not sure how to fix this myself as of yet. I can investigate deeper, but I thought there might be value in checking with you guys.

[rgbkrk]

I think the token semantics are different and that you'd have to turn off the XSRF protection and enable token only access.

[SimonBiggs]

One justification behind this was I was pretty keen to be able to work on writing a jupyterlab extension, have the extension hosted using a webpack dev server, and have the notebook server running in an "allow origin" mode from the webpack dev server.

It would be nice to be able to develop a jupyterlab extension and have the web browser automatically update as I write. Is there another way people have been achieving this during jupyterlab development?

I figured all I would need to do is boot up the notebook server with allow origins (and headers + methods), then update the jupyterlab settings services to point to the notebook server port. That way I can go to town with the benefits of the webpack dev server. Benefits such as webpack building everything directly in RAM instead of on disk and then via change detection rebuilding the necessary parts very quickly, and then auto refreshing the page. It makes development very nice. I figured it was worth trying to get up and running for the purpose of writing my extension.

[SimonBiggs]

Hi @rgbkrk for my immediate purposes disabling xsrf protection and using token only access worked.

NotebookApp.launch_instance(
        port=KERNEL_PORT, ip=ip, port_retries=0,
        allow_origin=allow_origin,
        certfile=certificate, 
        keyfile=key,
        token=auth_token,
        password='',
        open_browser=False,
        tornado_settings={
            "xsrf_cookies": False
        })