Configuring X-Frame-Options

This header can be configured in three ways:

Configuration	Resulting header
policy=”Disabled”	None
policy=”Deny”	X-Frame-Options: Deny
policy=”SameOrigin”	X-Frame-Options: SameOrigin

Register the middleware in the startup class:

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    ...

    app.UseStaticFiles();

    app.UseXfo(options => options.SameOrigin());

    app.UseMvc(...);
}

As an MVC attribute, defaults to policy=”Deny”:

[XFrameOptions]
[XFrameOptions(Policy = XFrameOptionsPolicy.SameOrigin)]

The header is omitted for redirects.