Configuring X-Frame-Options¶

This header can be configured in three ways:

Configuration Resulting header
policy=”Disabled” None
policy=”Deny” X-Frame-Options: Deny
policy=”SameOrigin” X-Frame-Options: SameOrigin

Register the middleware in the startup class:

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)


    app.UseXfo(options => options.SameOrigin());


As an MVC attribute, defaults to policy=”Deny”:

[XFrameOptions(Policy = XFrameOptionsPolicy.SameOrigin)]

The header is omitted for redirects.