bokeh.server.auth#

Framework-neutral authentication policy for Bokeh server frontends.

class AuthPolicy(authenticator: Authenticator, *, login_url: LoginURL | None = None, logout_url: str | None = None)[source]#

Authenticate Bokeh requests without depending on a web framework.

The authenticator receives a framework-neutral ServerRequest and returns an authenticated user, or None to reject the request. Both synchronous and asynchronous authenticators are supported.

Parameters:

  • authenticator – Function that authenticates an HTTP or websocket request and returns its user.

  • login_url – Optional URL, or request-dependent URL function, used to redirect unauthenticated HTTP requests. Without one, Bokeh returns HTTP 401.

  • logout_url – Optional URL exposed as curdoc().session_context.logout_url. The host application is responsible for implementing the endpoint.

async authenticate(request: ServerRequest) → Any | None[source]#

Return the authenticated user for a request, or None.

get_login_url(request: ServerRequest) → str | None[source]#

Return the login URL for an unauthenticated HTTP request.

async get_login_url_async(request: ServerRequest) → str | None[source]#

Return a request-specific login URL without blocking the event loop.

property logout_url: str | None#

The logout URL exposed to authenticated Bokeh sessions.