@@ -22,15 +22,15 @@ Using nbgrader with JupyterHub
22
22
23
23
.. warning ::
24
24
25
- For security reason , ``iframe `` are not allowed with JupyterHub from version 4.1. The
25
+ For security reasons , ``iframe `` are not allowed with JupyterHub from version 4.1. The
26
26
documentation about this security change is at
27
27
`mitigating-same-origin-deployments <https://jupyterhub.readthedocs.io/en/stable/explanation/websecurity.html#mitigating-same-origin-deployments >`_.
28
28
29
- In the current version of nbgrader, The ``formgrader `` UI embedded in an ``iframe `` to
30
- be available in a new tab of Jupyterlab or Notebook. Therefore, the formgrader UI can'tab
29
+ In the current version of nbgrader, the ``formgrader `` UI is embedded in an ``iframe ``, to
30
+ be available in a new tab of Jupyterlab or Notebook. Therefore, the `` formgrader `` UI can't
31
31
be loaded when using ``jupyterhub>=4.1 ``, and shows a blank panel instead.
32
32
33
- There are several way to use the ``formgrader `` with ``jupyterhub>=4.1 ``, see details
33
+ There are several ways to use the ``formgrader `` with ``jupyterhub>=4.1 ``, see details
34
34
at :ref: `jupyterhub-4.1 `.
35
35
36
36
@@ -353,14 +353,17 @@ Formgrader with ``jupyterhub>=4.1``
353
353
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
354
354
355
355
As explained above in the warning, ``jupyterhub>=4.1 `` does not allow iframe for security
356
- reason, which lead a blank panel instead of the ``formgrader `` UI.
356
+ reasons, which lead to blank panel instead of the ``formgrader `` UI.
357
+
358
+ Below are different ways to use the ``formgrader `` UI with ``jupyterhub>=4.1 ``.
357
359
358
360
Opening the ``formgrader `` UI in a new browser tab
359
361
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
360
362
361
- Web browsers allow to open iframe in a new browser tab, which allow using the ``formgrader ``
362
- without any additional setting.
363
- For example with Firefox, right clicking on the iframe shows a context menu to open the content in a new browser tab.
363
+ Web browsers are able to open iframes in a new browser tab, which allows using the
364
+ ``formgrader `` without any additional setting on the jupyterhub server.
365
+ For example with Firefox, right clicking on the iframe shows a context menu to open the
366
+ contents in a new browser tab.
364
367
365
368
.. image :: images/jupyterhub_4.1_iframe.png
366
369
@@ -372,7 +375,7 @@ Enabling JupyterHub subdomains
372
375
373
376
Enabling per-user and per-service subdomains with ``JupyterHub.enable_subdomains = True ``
374
377
allows to securely use iframes with JupyterHub.
375
- Then even if embedding in an IFrame is allowed, the host page does not have access to the
378
+ Then, even if embedding in an IFrame is allowed, the host page does not have access to the
376
379
contents of the frame.
377
380
378
381
In this case, the ``"frame-ancestor 'self'" `` can be restored in the application:
@@ -390,7 +393,7 @@ Trusting users (less secure)
390
393
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
391
394
392
395
If you trust users and are aware of the security vulnerability, it is also possible to
393
- enable the iframe with the same configuration as above without subdomains.
396
+ enable the iframe with the same configuration as above, without subdomains.
394
397
395
398
This is the solution used in the JupyterHub docker
396
399
`demo <https://github.com/jupyter/nbgrader/tree/main/demos >`_.
0 commit comments