ASP.NET MVC 5 默认不发送 X-Frame-Options 标头

Question

This article seems to suggest that an ASP.NET MVC 5 website automatically sends the X-Frame-Options HTTP header with the value SAMEORIGIN .

I would like that by default, I am observing that for my website , it doesn't.

Even adding the following line of code, which would have been unnecessary if the default behavior would have been to send the header, does not seem to send it.

AntiForgeryConfig.SuppressXFrameOptionsHeader = false;

I can add an action filter attribute and do that explicitly. But I was wondering if I were missing something if I wanted to have that header be sent by default with the SAMEORIGIN value?

I am using ASP.NET MVC 5.2.4 targeting .NET Framework 4.6.1.

Answer 1

It will it add by default if you will use @Html.AntiForgeryToken() on a view. If you don't use it, you need to add this header explicitly eg in the action filter attribute.