How can we prevent a clickjacking attack using iframes etc. in .Net MVC core application?


If your application is hosted with IIS you can activate the X-Frame-Options header in web.config.

    <add name="X-Frame-Options" value="DENY" />

Other ways for using X-Frame-Options are described here.

A more modern approach would be using the Content Security Policy.

Content-Security-Policy: frame-ancestors 'none';

For older browsers which don't understand these headers you could also use a framekiller script, but this is outdated and not always completely secure.

  • frame-src is incorrect, that only restricts which sources are available to an IFrame or Frameset. frame-ancestors is the one to use. – SilverlightFox Jul 17 '17 at 8:46
  • You are right. I fixed it. – floworbit Jul 17 '17 at 9:02

One way is adding the HTTP headers in to your response as decribed in other answer. This is common to any Web application and following are the options you can use.

  • DENY :
  • SAMEORIGIN : Allow only to your domain
  • ALLOW-FROM : You can specify any domain to allow

Since you have asked about .Net Core specifically , following is the way you can implement security in your middleware.


You can use any option in your middle ware this way in your code.

Not the answer you're looking for? Browse other questions tagged or ask your own question.