Troubleshooting: "X-Frame-Options: SAMEORIGIN" Header Breaks the Use of iFrames

Version Affected: 19.07.x and above
 
 

Overview

Starting in 19.07.x, SecureAuth sets an X-Frame-Options header with a value of SAMEORIGIN on every response. This can break the use of iFrames that embed a SecureAuth realm from a different origin.

Cause

This header is set by ASP.NET's AntiForgery protection, which SecureAuth enables by default to help protect against clickjacking.

Resolution:

If you need to allow the realm to be embedded in an iFrame from a different origin, you can suppress this header by adding one line to the realm's theme code-behind file. To resolve this:

1. Navigate to the theme folder for the realm, for example D:\Secureauth\SecureAuth2\Themes\2019\.
2. Take a backup of the theme's master page code-behind file, for example SecureAuth2019.Master.vb.
3. Open the code-behind file and add the following line inside the Page_Load method:
   

   AntiForgeryConfig.SuppressXFrameOptionsHeader = true

4. Save the file.

Special Considerations

We don't recommend disabling this protection unless you specifically need to allow the realm to be embedded in an iFrame from a different origin.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.