Search code examples
asp.net-mvcx-frame-options

What happens if both X-Frame-options SAMEORIGIN and DENY is passed in response header?

I have 2 questions. 1.What happens if response header contains x frame options as hoth sameorigin and deny? Will it allow iframe from same origin?

  1. What happens if I set x frame options in both in IIS and in my application? Will it leads to 2 x frame options?
Solution
    1. This could depend on the browser and the order of headers, but most likely the strictest value will be used. You will test with various browsers and configurations.
    2. Yes. Note that if you set the same header in multiple levels in IIS your application will fail to start, but it will work if you set it in code and as a response header in IIS.