Python Interactive Window starts up Jupyter server listening on localhost, open to all

[nimish]

Bug: Notebook Editor, Interactive Window, Python Editor cells

Steps to cause the bug to occur

1. Run anything in the python interactive window
2. Go to http://localhost:8888 (or whatever a jupyter host would do on your machine)
3. Mess about with a jupyter server listening on localhost

Actual & Expected behavior

Actual: It's not a great idea to spin up a globally-listening server that can execute arbitrary code as a side effect of an IDE

Expected: the jupyter server is accessed using UNIX domain sockets/ whatever NT uses: jupyter/notebook#4835

Your Jupyter and/or Python environment

VS Code latest, mac OS 10.15

[DonJayamanne]

Oops, closed accidentally

[rchiodo]

This is not an issue because even though it opens that port, it won't accept traffic unless you provide the token. We don't expose the token anywhere, so our app is the only thing that can talk to that port.

Here's what you get if you just type in http://localhost:8888 from a browser after we start it:

[nimish]

I'm able to actually login and use the jupyter notebook that VS Code launches, and I've confirmed I don't have any other jupyter servers up. Potentially related to having cookies for this jupyter server when run in a different context.

It's more concerning that the extension doesn't warn that a globally listening server is launched (eating a port, but that's less important). Further, there is an alternative that has none of these issues: use the unix domain sockets which NT supports too, or embed the ipython shell.

[rchiodo]

Yes cookies will make it work on your local box. But if you try from somewhere else it won't be available (or if you clear your cookies).

[rchiodo]

Note: Unix Domain Sockets likely requires support from Jupyter Server as they're the one opening the port.

[rchiodo]

Jupyter issue about this already:
jupyter/notebook#2503

[greazer]

Thanks for the feedback, @nimish. We're going to close because we believe this is a jupyter issue.