Set CSP frame-ancestors 'self' for nbgrader handlers

jupyter · Aug 26, 2024 · 90f8d37 · 90f8d37
1 parent ef44180
commit 90f8d37
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/nbgrader/server_extensions/formgrader/base.py b/nbgrader/server_extensions/formgrader/base.py
@@ -60,6 +60,10 @@ def api(self):
         api.log_level = level
         return api
 
+    def initialize(self):
+        super().initialize()
+        self.set_header("Content-Security-Policy", "frame-ancestors 'self'")
+
     def render(self, name, **ns):
         template = self.settings['nbgrader_jinja2_env'].get_template(name)
         return template.render(**ns)