{"id":487,"date":"2013-11-28T14:45:32","date_gmt":"2013-11-28T03:45:32","guid":{"rendered":"http:\/\/blog.quppa.net\/?p=487"},"modified":"2013-11-28T14:45:32","modified_gmt":"2013-11-28T03:45:32","slug":"html-antiforgerytoken-sets-an-x-frame-options-header-with-the-value-sameorigin","status":"publish","type":"post","link":"https:\/\/www.quppa.net\/blog\/2013\/11\/28\/html-antiforgerytoken-sets-an-x-frame-options-header-with-the-value-sameorigin\/","title":{"rendered":"Html.AntiForgeryToken() sets an X-Frame-Options header with the value 'SAMEORIGIN'"},"content":{"rendered":"

I recently migrated a project from ASP.NET MVC 4 to MVC 5<\/a> and the process went quite smoothly, except that all of a sudden my webpages were being returned with the X-Frame-Options<\/code> header set with the value ‘SAMEORIGIN<\/code>‘. This is actually a reasonable default as it helps mitigate the risk of ClickJacking<\/a>. The website in question, however, is designed to run in an iFrame, and this header immediately caused issues.<\/p>\n

After a fruitless search of all my code in Visual Studio for ‘X-Frame-Options’ and ‘SAMEORIGIN’, I decided to try Windows Grep<\/a> as a last resort, and it found that ‘SAMEORIGIN’ was present in System.Web.WebPages.dll<\/a>. Thanks to Microsoft making ASP.NET MVC open source<\/a>, I was able to find the relevant code quite easily on GitHub; it turns out that the AntiForgeryWorker class<\/a> adds the header when you call Html.AntiForgeryToken() as of August this year. Even better, there’s an easy way to prevent this behaviour: set the static property AntiForgeryConfig.SuppressXFrameOptionsHeader<\/code> to true<\/code> (I’ve done this in my Application_Start() method). MSDN doesn’t<\/del> didn’t even document this property yet<\/del><\/a>, so I’m lucky to have found it. Two other bloggers have written about this in English<\/a> and Japanese<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

I recently migrated a project from ASP.NET MVC 4 to MVC 5 and the process went quite smoothly, except that all of a sudden my webpages were being returned with the X-Frame-Options header set with the value ‘SAMEORIGIN‘. This is actually a reasonable default as it helps mitigate the risk of ClickJacking. The website in … Continue reading “Html.AntiForgeryToken() sets an X-Frame-Options header with the value 'SAMEORIGIN'”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[19],"class_list":["post-487","post","type-post","status-publish","format-standard","hentry","category-programming","tag-asp-net-mvc-headers-iis"],"_links":{"self":[{"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/posts\/487","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/comments?post=487"}],"version-history":[{"count":0,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/posts\/487\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/media?parent=487"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/categories?post=487"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quppa.net\/blog\/wp-json\/wp\/v2\/tags?post=487"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}