...
With OAuth2 enabled, when an unauthenticated user tries to access or perform an action against ModelOp Center using an external Jupyter notebook, they will not be allowed to do so until they authenticate. The trigger for the authentication logic, located in the jupyter-plugin repository, is a 401 Unauthorized status code. However, Spring Security configured as OAuth2Login , is no longer sending a 401 Unauthorized, but instead , a 302 Found status code. To override the 302 Found status code, we introduced the CustomAuthenticationEntryPoint class. The purpose of this class is to inspect all requests for protected resources coming from an unauthenticated user, and to determine if a 302 Found or 401 Unauthorized status code should be returned.
We identify external Jupyter notebook requests (non-browser requests) by checking for the Sec-Fetch-Mode Accept header and its value. If a request is coming from an external Jupyter notebook (non-browser request), then Sec-Fetch-Mode the Accept header will be set with the cors not contain the text/html value, in which case we return 401 Unauthorized. Otherwise, we return 302 Found and redirect to the login page.
...