Python notebooks and sharing

Question

I'm a beginner when it comes to programming or servers. I installed Python (programming language) as well as Jupyter notebook as part of an online course project. After installation, I was simply following instructions and typed "jupyter notebook" in the command prompt.

The following text appeared in the command prompt:

> Writing notebook server cookie secret to (folder name)
> Serving notebooks from local directory: (folder name)
> ...

After this, my local folder contents appeared in a browser window. This seemed quite scary, as if everyone using the same application now had access to my hard drive.

Does anyone know if this is part of what the Jupyter notebook is supposed to do? And if it is not, why do they make it seem extremely suspicious? I mean come on, the application said "Serving notebooks from local directory" - even though I realize that a notebook is a Jupyter project type, it is still the most confusing output line I've ever read when running a computer program.

Answer 1

If you start the juypter notebook server it will generate an authorization token and a URL which uses this token. If you look further at the output you will see something like this:

[I 06:02:28.891 NotebookApp] The Jupyter Notebook is running at: http://localhost:8888/?token=e2b7d4eb14d22f46a7950ccb01aecaf303951cb6fbe87fa9

Everybody which knows this URL can connect to the notebook and is considered authorized. Thus, the URL or this token should be treated like a password.

...as if everyone using the same application now had access to my hard drive.

Everybody using the same application and the same authorization token has access to the local folder (not the whole hard drive). This is similar to for example sharing a folder within Windows and giving others the path and the password to it.

... even though I realize that a notebook is a Jupyter project type

From within the Juypter notebook you have access to files inside the local directory too. This is for example needed to include local data into computations done inside your notebook.

Answer 2

It is an extension of Steffen's answer.

Everybody which knows this URL can connect to the notebook and is considered authorized. Thus, the URL or this token should be treated like a password

The first important thing is that your notebook server is running at localhost which means it is accessible only for people logged to your machine. However I guess it may somehow depend on your network configuration.

Nevertheless, you are connecting locally to your machine from your machine. If any of other users of the machine is able to evesdrop your connection (it is plain HTTP) and steal your authentication token, that means the one probably has enough privileges to access your local directory without resorting to Jupyter.

However if you decide to run the server at your external IP address (to connect to it remotely) - then you may be in a trouble since your token is exposed to anyone between you and your server.

From within the Juypter notebook you have access to files inside the local directory too. This is for example needed to include local data into computations done inside your notebook.

Also keep in mind that Python code in the notebook itself has access to all files you are privileged to access - not only to the local directory. Which is a reason you are advised not to run notebooks from untrusted sources.