Configuring X-Frame-Options¶

This header can be configured in three ways:

Configuration Resulting header
policy=”Disabled” None
policy=”Deny” X-Frame-Options: Deny
policy=”SameOrigin” X-Frame-Options: SameOrigin

NWebsec: In web.config

<x-Frame-Options policy="Disabled"/>

NWebsec.Owin: Register the middleware in the OWIN startup class:

using NWebsec.Owin;
...
public void Configuration(IAppBuilder app)
{
    app.UseXfo(options => options.SameOrigin());
}

NWebsec.Mvc: As an MVC attribute, defaults to policy=”Deny”:

[XFrameOptions]
[XFrameOptions(Policy = XFrameOptionsPolicy.SameOrigin)]

The header is omitted for redirects.