Configure Content Security Policy (CSP)

[astrojuanlu]

I was trying to access voila from a non-localhost IP and I was getting some CSP violations, so following @Carreau's advice here I added the following configuration:

--- /home/juanlu/.local/share/virtualenvs/poseidon-oYfLlCwx/src/voila/voila/app.py.old	2018-11-28 01:31:54.073333937 +0100
+++ /home/juanlu/.local/share/virtualenvs/poseidon-oYfLlCwx/src/voila/voila/app.py	2018-11-28 01:32:45.897266756 +0100
@@ -141,8 +141,7 @@
             jinja2_env=env,
             static_path='/',
             server_root_dir='/',
-            contents_manager=contents_manager
+            contents_manager=contents_manager,
+            headers={'Content-Security-Policy': "frame-ancestors 'self' http://host.eu"},
         )
 
         base_url = webapp.settings.get('base_url', '/')

Is there a better way to do it?

[maartenbreddels]

Not for the moment, I think we should have a similar command line option though. Actually, we should think how we can reuse some of the notebook command line options.

[SylvainCorlay]

This should already work when using as a notebook or jupyter_server extension.

Exposing these to the voila standalone app should not be difficult but it is not in yet.

[timkpaine]

@Juanlu001 @SylvainCorlay @maartenbreddels WIP in #89, tests failing though, will work on it

[timkpaine]

@Juanlu001 can you check if this is fixed by #69

[astrojuanlu]

Sorry, not working with voila at the moment ☹️

[maartenbreddels]

This should be fixed by #69 indeed, if not, please reopen.