X-Frame-Options bug in ASP.NET MVC (.NET 4.5.1)

Question

Does anyone know why the response returned by an ASP.NET MVC controller contains the X-FRAME-OPTIONS: SAMEORIGIN header so many times? I think this might be a bug in the framework (using version 4.5.1).

It seems as though the header is added once for each form on the page. My work around is to disable the header in MVC and add it in the web.config file instead, like this:

Global.asax.cs:

protected void Application_Start()
{
    System.Web.Helpers.AntiForgeryConfig.SuppressXFrameOptionsHeader = true;
}

Web.config:

<system.webServer>
  <httpProtocol>
      <customHeaders>
        <add name="X-Frame-Options" value="SAMEORIGIN" />
      </customHeaders>
  </httpProtocol>
</system.webServer>

Answer 1

The header is added each time you call @Html.AntiForgeryToken(). Which means if you have multiple forms on your pages and each form includes that call, you'll get duplicate headers.

A comment to the question references this blog: http://daveonsoftware.blogspot.ru/2015_03_01_archive.html . I think that's a good explanation of the problem. In my application, I picked option #3.