Removing X-Frame-Options being added automatically only in Login page

Question

I am developing an ASP.NET MVC application which needs to be loaded inside an iframe in another website. But the login page just won't appear inside the iframe because an Header is being sent in the response X-Frame-Options which is set to SAMEORIGIN. Browser is not displaying the page in iframe because of this. I already Googled and tried multiple things but nothing worked.

I am using ASP.NET forms authentication. May be in this case IIS adds this header in login page for added security. But I need to get rid of this in my use case.

I tried adding a custom header

<httpProtocol>   <customHeaders>     <add name="X-Frame-Options" value="ALLOW" />   </customHeaders> </httpProtocol> 

But the SAMEORGIN is still being added in the header with comma.

I also tried adding Header value from C# using Response.Headers["X-Frame-Options"] = "ALLOW". It cause two headers with the same name.

I also tried this in web.config

<customHeaders>     <remove name="X-Frame-Options" /> </customHeaders> 

It also didn't worked.

Answer 1

MVC 5 automatically adds an X-Frame-Options Header, so go to your Global.asax file and add this to the Application_Start() method:

System.Web.Helpers.AntiForgeryConfig.SuppressXFrameOptionsHeader = true; 

Please note that especially for a login page it is bad practice to remove this header, because it opens up your site for login credentials phishing attacks. So if this site of yours is publicly accessable I strongly recommend to keep this header.