fix(security): clean url from trame search params

README.rst

@@ -65,6 +65,8 @@ Trame client is the JS core of trame and can be tuned by url parameters. The tab
      - When set this will load an extra script that will use a service worker to enable SharedArrayBuffer
    * - ui
      - Layout name selector. When a trame app define several layout with different name, you can choose which layout should be displayed
+   * - remove
+     - By default the URL will be cleaned from trame config parameters (sessionURL, sessionManagerURL, secret, application) but if additional parameters should be removed as well but used in the launcher config, this can be achieved by adding a `&remove=param1,param2`.
 
 The table below leverage environment variables, mainly for the Jupyter Lab context and the iframe builder configuration.
 

vue2-app/src/components/Connect/wslink/index.js

@@ -119,6 +119,21 @@ function getClient(name) {
     );
   }
 
+  // Remove any URL parameters once config generated
+  const params = new URL(window.location).searchParams;
+  const paramsToClean = [
+    "sessionURL",
+    "sessionManagerURL",
+    "secret",
+    "application",
+    "remove",
+  ].concat(params.get("remove")?.split(",") || []);
+  paramsToClean.forEach((v) => params.delete(v));
+  const cleanURL = `${window.location.pathname}${
+    params.size ? "?" : ""
+  }${params.toString()}${window.location.hash}`;
+  window.history.replaceState({}, document.title, cleanURL);
+
   return client;
 }
 

vue3-app/src/main.js

@@ -25,6 +25,21 @@ async function start() {
     useUrl: true,
   });
 
+  // Clean URL params once config is generated
+  const params = new URL(window.location).searchParams;
+  const paramsToClean = [
+    "sessionURL",
+    "sessionManagerURL",
+    "secret",
+    "application",
+    "remove",
+  ].concat(params.get("remove")?.split(",") || []);
+  paramsToClean.forEach((v) => params.delete(v));
+  const cleanURL = `${window.location.pathname}${
+    params.size ? "?" : ""
+  }${params.toString()}${window.location.hash}`;
+  window.history.replaceState({}, document.title, cleanURL);
+
   // Handle connection
   trame.addConnectListener(() => {
     trame.client.onConnectionError((httpReq) => {