MVC 5 prevents access to content via Iframe

asp.net-mvc

Solution

MVC5 automatically adds the HTTP header X-Frame-Options with `SAMEORIGIN`. This prevents your site from being loaded into an `iframe`.

But we can turn this off in `Application_Start` in the `Global.asax.cs`.

Example

protected void Application_Start()
{
    AntiForgeryConfig.SuppressXFrameOptionsHeader = true;
}

Update

I have written a post about this MVC5 prevents your website being loaded in an IFRAME

Problem

Ever since the upgrade from MVC4 to MVC5, I have noticed an extra server header added to my web pages: X-Frame-Options: SAMEORIGIN I understand security benefits of adding this tag, but one of the pages is meant to be included inside an iframe from other projects (on other domains), this extra header is preventing this. I have verified it is not the hosting IIS7 server that is adding the header, and when I downgraded back to MVC4 - the header is gone. Does anyone know how to remove this default from MVC5?

Original source

Related problems