Revert #1915 for security reason

[brichet]

This PR reverts #1915 for security reason.

Jupyter application running in JupyterHub must not allow iframes, as described at mitigating-same-origin-deployments.

This PR also updates the demo and documentation to make nbgrader work with jupyterhub>=4.1.

EDIT:

• Fixes a security advisory published at GHSA-fcr8-4r9f-r66m
• This fix has been release in v0.9.5

[github-actions]

👈 Launch a Binder on branch brichet/nbgrader/revert#1915_

[lahwaacz]

So nbgrader should be revamped to avoid using iframes altogether...

[brichet]

So nbgrader should be revamped to avoid using iframes altogether...

AFAIK only the formgrader UI is using an iframe, and there are solutions to use it with JupyterHub (see updated doc).

Revamping the formgrader UI would be the best solution indeed, but it would take some time.

[minrk]

This second sentence isn't quite accurate - frame-ancestors: self allows same-origin iframes which do still have access to the page contents. That's not strictly the problem. The important change is that when enable_subdomains is True, frame-ancestors self allows embedding the iframe only on pages served by the user's own server but not on other users' servers, which is the problem case for a single-origin JupyterHub deployment.

[minrk]

Thanks! One suggestion to improve the accuracy of the docs a bit.

[brichet]

Thanks again @minrk for the advisory, the possible solutions and the review.