title: Removing "X-Frame-Options" header for a specific controller only
body: <p>I am trying to remove the "X-Frame-Options" header for only a specific controller's actions using:</p>
  
  <pre><code>protected override void OnResultExecuting(ResultExecutingContext filterContext)
  {
      filterContext.HttpContext.Response.Headers.Remove("X-Frame-Options");
      base.OnResultExecuting(filterContext);
  }
  </code></pre>
  
  <p>However, that doesn't seem to work at all.  The only way I can get it to work at all on my site is to add this code to the global.asax below.  I am pretty sure I am missing the correct step in the ASP.NET MVC / IIS pipeline that allows me to overwrite the IIS setting of that header.  Is this possible?</p>
  
  <pre><code>protected void Application_EndRequest()
  {
      Response.Headers.Remove("X-Frame-Options");
  }
  </code></pre>
  
  <p>As for why I want to do this, I am building a widget that user's will be able to use on their personal sites through the use of an iframe, but allow them to post back information to our site.  I realize there are security implications to turning this header off, and while I welcome any suggestions on how to mitigate those risks, I just want to know if what I am asking is possible.</p>