RStudio infinite redirect loop with RStudio 2026.04+ (jupyter-rsession-proxy double-slash cookie path bug)

[cboettig]

Problem

RStudio is broken in JupyterHub with any image that includes RStudio Server 2026.04+. Navigating to the RStudio interface produces an infinite redirect loop:

/rstudio/  →  /rstudio/auth-sign-in?appUri=%2F  →  /rstudio/  →  ...

Root cause

jupyter-rsession-proxy builds the --www-root-path flag as:

cmd.append('--www-root-path={base_url}' + f'/{prefix}/')

{base_url} is substituted at runtime with the JupyterHub service prefix, e.g. /user/alice/ (trailing slash). Combined with the leading / before {prefix}, this produces a double slash: --www-root-path=/user/alice//rstudio/.

RStudio 2026.04 uses this value verbatim as the cookie path attribute:

Set-Cookie: user-id=...; path=/user/alice//rstudio; HttpOnly

The browser then stores cookies at /user/alice//rstudio but requests arrive at /user/alice/rstudio/ — the path never matches, so the session cookie is never sent back, and RStudio loops to auth-sign-in forever. (Older RStudio versions silently normalized the double slash; 2026.04 does not.)

Fix

Already merged in jupyterhub/jupyter-rsession-proxy main (one-line fix) — drop the leading / before {prefix}:

cmd.append('--www-root-path={base_url}' + f'{prefix}/')

But the fix is not yet released to PyPI (latest is 2.5.0, released 2026-04-28, which predates the fix).

Request

Until a new PyPI release is cut, please update requirements-cpu.txt (and requirements.cuda.txt if applicable) to install from the upstream main branch:

jupyter-rsession-proxy @ git+https://github.com/jupyterhub/jupyter-rsession-proxy.git@main

This will unblock all JupyterHub users running RStudio with the current rocker images.