Securing my ASP.net MVC3 Website aganist "Click jacking"

Question

Recently I was flipping through some security issues faced by websites. Fortunately come across a new term "Click jacking"

I understood that this attack happens only if my website is loadable in an IFrame.

Further investigation helped to know that setting "x-frame-options" to "DENY" prevent the website been loaded in IFrame

But I Don't know how to implement this as I am very new to this domain?

Answer 1

In your Global.asax you can add the following

protected void Application_BeginRequest(object sender, EventArgs e)
{
    HttpContext.Current.Response.AddHeader("x-frame-options", "SAMEORIGIN");
}

Answer 2

Just put following code under <system.webServer> section in web.config file

<httpProtocol>
  <customHeaders>
    <add name="X-Frame-Options" value="DENY"/>
  </customHeaders>
</httpProtocol>

NOTE : The X-Frame-Options header may contain one of three tokens.You either add any of these.Each one has its own significance.

• DENY
• SAMEORIGIN
• ALLOW-FROM origin

For details visit MSDN blog : Combating ClickJacking With X-Frame-Options