title: Internet Explorer X-Frame-Options ALLOW-FROM not working in IE 11 and Edge
body: <p>I am having an issue using <code>X-Frame-Options</code> to embed one site as an iFrame into another (different domains) with IE 11 and Edge.  My research and experience indicate that IE doesn't yet support CSP Level 2 frame-ancestors, so I must use <code>X-Frame-Options</code>.  </p>
  
  <p>I have added the response header 
  <code>X-Frame-Options: ALLOW-FROM https://&lt;mysite&gt;.com</code>
  to the site that needs to be embedded.</p>
  
  <p>These are secured sites so I am unable to provide real URLs to this community.</p>
  
  <p>When I launch the main site, which contains an iFrame with content from the second site, I am able to see the <code>X-Frame-Options</code> header in the response for the iframe content and it looks to be applied correctly. However, IE indicates "...modified this page to help prevent cross-site scripting" and my frame contains only the <code>#</code> symbol.</p>
  
  <p>Due to timing and internal IT delays, I am unable to have both sites hosted in the same domain.</p>
  
  <p>Can anyone help to explain what I did wrong in implementing <code>X-Frame-Options</code> or if there is another option to achieve the desired effect?</p>