Set CSP frame-ancestors 'self' for nbgrader handlers (#1915)

Co-authored-by: Nicolas Brichet <nicolas.brichet@quantstack.net>
jupyter · Nov 15, 2024 · ba1e70b · ba1e70b
1 parent 0eaa4d5
commit ba1e70b
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/nbgrader/server_extensions/formgrader/base.py b/nbgrader/server_extensions/formgrader/base.py
@@ -60,6 +60,10 @@ def api(self):
         api.log_level = level
         return api
 
+    def initialize(self):
+        super().initialize()
+        self.set_header("Content-Security-Policy", "frame-ancestors 'self'")
+
     def render(self, name, **ns):
         template = self.settings['nbgrader_jinja2_env'].get_template(name)
         return template.render(**ns)