From 9b31234e0c5ce4a03318bd0a168ad6fd7a15bf11 Mon Sep 17 00:00:00 2001
From: Stephen Smith <stephen@curii.com>
Date: Thu, 16 Sep 2021 15:04:21 -0400
Subject: [PATCH] 17229: Clear webshell token from url after page loads

Arvados-DCO-1.1-Signed-off-by: Stephen Smith <stephen@curii.com>
---
 public/webshell/index.html | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/public/webshell/index.html b/public/webshell/index.html
index 6fa6f313..77800137 100644
--- a/public/webshell/index.html
+++ b/public/webshell/index.html
@@ -40,9 +40,12 @@
         }
 
         var trySendToken = function() {
+          var token = urlParams.get('token');
+          if (token) {
+            history.replaceState(null, "", `/webshell/?host=${encodeURIComponent(urlParams.get('host'))}&login=${encodeURIComponent(urlParams.get('login'))}`)
+          }
           // change this text when PAM is reconfigured to present a
           // password prompt that we can wait for.
-          var token = urlParams.get('token');
           if (findText("assword:")) {
              sh.keysPressed(token + "\n");
              sh.vt100('(sent authentication token)\n');
-- 
2.30.2