Removing "X-Frame-Options" header for a specific controller only

Question

I am trying to remove the "X-Frame-Options" header for only a specific controller's actions using:

protected override void OnResultExecuting(ResultExecutingContext filterContext)
{
    filterContext.HttpContext.Response.Headers.Remove("X-Frame-Options");
    base.OnResultExecuting(filterContext);
}

However, that doesn't seem to work at all. The only way I can get it to work at all on my site is to add this code to the global.asax below. I am pretty sure I am missing the correct step in the ASP.NET MVC / IIS pipeline that allows me to overwrite the IIS setting of that header. Is this possible?

protected void Application_EndRequest()
{
    Response.Headers.Remove("X-Frame-Options");
}

As for why I want to do this, I am building a widget that user's will be able to use on their personal sites through the use of an iframe, but allow them to post back information to our site. I realize there are security implications to turning this header off, and while I welcome any suggestions on how to mitigate those risks, I just want to know if what I am asking is possible.

Answer 1

OnResultExecuting happens too early in the MVC lifecycle. The header has not been set yet.

What you need is the OnResultExecuted method which is run after the View is rendered.

Here's how you write a filter class for what you are looking for:

using System.Web.Mvc;

namespace Test.Filters
{
    public class RemoveXFrameOptionsAttribute : ActionFilterAttribute
    {
        public override void OnResultExecuted(ResultExecutedContext filterContext)
        {
            filterContext.HttpContext.Response.Headers.Remove("X-Frame-Options");
            base.OnResultExecuted(filterContext);
        }
    }
}

Then to use it, decorate whatever Controller or Action you want this filter applied.

[RemoveXFrameOptions]
public class TestController : Controller
{
    public ActionResult Index()
    {
        return View();
    }
}

or

public class TestController : Controller
{
    [RemoveXFrameOptions]
    public ActionResult Index()
    {
        return View();
    }
}