Refused to display '' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'

Question

I've made an MVC ASP.NET C# project which is mainly a form.

However when I iframe the correct url, it shows up as blank

NOTE: i haven't done any line of code regarding iframe

Is there an option i need to turn on to make it possible to iframe?

FirefoxConsole Error message:

Load denied by X-Frame-Options: http://localhost:2053/Persons/Create does not permit cross-origin framing.

 Chrome Error message: 

  Refused to display 'http://localhost:2053/Persons/Create' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

can you browse to that url normally? (ie not in an iframe), and can you post the code from the iframe page? — markpsmith, Nov 14 '14 at 14:23
You've completely changed the error message! gaaa I give up. — markpsmith, Nov 14 '14 at 14:42
i know, i accidently removed the head from my local test file, my bad man — SNT, Nov 14 '14 at 14:46

score 18 · Accepted Answer · answered Nov 14 '14 at 16:02

18

found the solution: add this to global.asax.cs

  protected void Application_PreSendRequestHeaders()
    {
        Response.Headers.Remove("X-Frame-Options");
         Response.AddHeader("X-Frame-Options", "AllowAll");

    }

answered Nov 14 '14 at 16:02

SNT

293
1
2
13

1

My situation: I made a application in ASP.NET MVC 5 and then try to render on a iframe in Sharepoint site, i got the error that says in the tittle of this post, and with your answer everything works fine. I want to know where did you find this answer? just to future documentation. – mejiamanuel57 Apr 18 '16 at 17:44
Is "AllowAll" value a part of any specification? If is not mentioned here: https://tools.ietf.org/html/rfc7034 – C-F Jan 30 '18 at 01:01

Refused to display '' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'

1 Answers1

Linked