I have a recently upgraded solution, now running on Sitecore 8.1-upd3. Apparently in this version, Sitecore includes a http module to include a X-Frame-Options header, set to
<add type="Sitecore.Web.XFrameOptionsHeaderModule, Sitecore.Kernel" name="SitecoreXFrameOptionsHeaderModule" />.
All very nice, but my customer wants it set to
DENY for the CD servers. I checked the code from the module and the value is rather hardcoded, although there is a check not to overwrite an existing value:
HttpResponse response = HttpContext.Current.Response; if (!Enumerable.All<string>((IEnumerable<string>) response.Headers.AllKeys, (Func<string, bool>) (key => key != "X-Frame-Options")) || !(response.ContentType == "text/html")) return; response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
What would be the best way to set this header to
DENY? (considering maintainability, performance, effort, ...)