asp.net-mvciframex-frame-options

SuppressXFrameOptionsHeader = true not removing x-frame-origin

I have a .net MVC app running on 4.6.1 I am trying to make a page work in an iFrame. I read the best way to do this is to update SuppressXFrameOptionsHeader in Global.asax. So I did that:

System.Web.Helpers.AntiForgeryConfig.SuppressXFrameOptionsHeader = true;

But I cannot for the life of me get rid of the X-Frame-Origin header. I do not have any x-frame-origin settings set in web.config.

I am following instructions found here to turn off the header on application_start, then add it back as a global filter, then remove it on a page by page basis. But I can't even get the first step to work where I remove the header from the entire application.

Is there anywhere else this could be set I am overlooking?

enter image description here

Solution

  • An alternative approach could be to use the fact that all modern browsers (that excludes IE11) will ignore X-Frame-Options if Content-Security-Policy frame-ancestors directive is set.

    You can set the header "Content-Security-Policy: frame-ancestors 'self' <host(s) of sites to allow>;"