8

I have a recently upgraded solution, now running on Sitecore 8.1-upd3. Apparently in this version, Sitecore includes a http module to include a X-Frame-Options header, set to SAMEORIGIN: <add type="Sitecore.Web.XFrameOptionsHeaderModule, Sitecore.Kernel" name="SitecoreXFrameOptionsHeaderModule" />.

All very nice, but my customer wants it set to DENY for the CD servers. I checked the code from the module and the value is rather hardcoded, although there is a check not to overwrite an existing value:

HttpResponse response = HttpContext.Current.Response;
if (!Enumerable.All<string>((IEnumerable<string>) response.Headers.AllKeys, (Func<string, bool>) (key => key != "X-Frame-Options")) || !(response.ContentType == "text/html"))
    return;
response.Headers.Add("X-Frame-Options", "SAMEORIGIN");

What would be the best way to set this header to DENY? (considering maintainability, performance, effort, ...)

Improve this question

1 Answer 1

Reset to default
13

I think your best option (requiring no code or overwrites) would be to configure UrlRewrite to filter out the header. There are already half a dozen reasons why you might have this module installed already on your server - might as well use it.

Open up UrlRewrite for your site, and click "View Server Variables".

enter image description here

Then add your X-Frame-Options header.

Then proceed to create an Outbound Rule where you explicitly rewrite your X-Frame-Options header to DENY as required.

enter image description here

Source: Remove Unwanted HTTP Response Headers

Improve this answer
2
  • Note that you need to specify variable name as RESPONSE_X-Frame-Options, not just X-Frame-Options and you don't need to add a "Server Variable" for this to work.
    – user1069816
    Commented May 10, 2018 at 12:32
  • You should end up with a section like this in the web.config - <outboundRules> <rule name="X-Frame-Options" patternSyntax="Wildcard"> <match serverVariable="RESPONSE_X-Frame-Options" pattern="*" /> <action type="Rewrite" value="DENY" /> </rule> </outboundRules>
    – user1069816
    Commented May 10, 2018 at 12:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.