DEV: Allow configuration of default headers.

Applies Content-Security-Policy: frame-ancestors 'self' by default.

jupyterhub/handlers/base.py

@@ -71,6 +71,17 @@ class BaseHandler(RequestHandler):
         self.db.rollback()
         super(BaseHandler, self).finish(*args, **kwargs)
 
+    def set_default_headers(self):
+        """
+        Set any headers passed as tornado_settings['headers'].
+
+        By default sets Content-Security-Policy of frame-ancestors 'self'.
+        """
+        headers = self.settings.get('headers', {})
+        headers.setdefault('Content-Security-Policy', "frame-ancestors 'self'")
+        for header_name, header_content in headers.items():
+            self.set_header(header_name, header_content)
+
     #---------------------------------------------------------------
     # Login and cookie-related
     #---------------------------------------------------------------

jupyterhub/tests/test_api.py

@@ -64,7 +64,9 @@ def api_request(app, *api_path, **kwargs):
     url = ujoin(base_url, 'api', *api_path)
     method = kwargs.pop('method', 'get')
     f = getattr(requests, method)
-    return f(url, **kwargs)
+    resp = f(url, **kwargs)
+    assert resp.headers['Content-Security-Policy'] == "frame-ancestors 'self'"
+    return resp
 
 def test_auth_api(app):
     db = app.db