Restrict which sites can embed Graph Explorer in a frame

[kmcginnes]

The proxy server serves the Graph Explorer UI with no framing policy, so any site can load it in an iframe. Graph Explorer has no reason to be embedded cross-origin by default, so the server should say so.

• Send Content-Security-Policy: frame-ancestors 'self' from the proxy server, at least on the UI's HTML responses. Optionally also send X-Frame-Options: SAMEORIGIN for older browsers.
• Before choosing the default, check whether any supported deployment embeds Graph Explorer from another origin, in particular the Neptune notebook path (/proxy/9250). If one does, add an env var that lets the deployer list allowed frame origins, following the PROXY_SERVER_ALLOWED_DB_ORIGINS pattern.
• Document the setting in docs/references/security.md.

The middleware stack is in packages/graph-explorer-proxy-server/src/app.ts (createApp). The UI is served through express.static at staticFilesVirtualPath.

Important

Internal only — this issue is maintained by the core team and is not accepting external contributions.