    def content_security_policy(self):
        """The default Content-Security-Policy header

        Can be overridden by defining Content-Security-Policy in settings['headers']

        ..versionchanged:: 4.1

            Change default frame-ancestors from 'self' to 'none'
        """
        return '; '.join(
            ["frame-ancestors 'none'", "report-uri " + self.csp_report_uri]
        )
The default Content-Security-Policy header

Can be overridden by defining Content-Security-Policy in settings['headers']

..versionchanged:: 4.1

Change default frame-ancestors from 'self' to 'none'
jupyterhub/handlers/base.py