How to change X-Frame-Options" from DENY to SAMEORIGIN

Question

I'm working with ASP.NET. Due to security reasons I hadto set X-Frame-Options to DENY in Web.Config. But the site contains some iframes. So, I have to change the X-Frame-Options to SAMEORIGIN from time to time.

In the Page_PreRender event I have written the following code:

HttpContext.Current.Response.Headers.Remove("X-Frame-Options");
HttpContext.Current.Response.AppendHeader("X-Frame-Options", "SAMEORIGIN");
```

But I still get the DENY option from the web config.

Please, any ideas?

Answer 1

Have a look at this answer: https://stackoverflow.com/a/42168501/970074

Depending on your project, you'll likely want to look at another location to insert the "DENY" instead of in the web.config so that you can override it when necessary with "SAMEORIGIN". Action filters would be a good place to do this if you're using MVC.