title: Cross domain communication is not happening after adding Xframeoptions : Sameorigin
body: <p>I am working on implementing prevention of Clickjacking for our site. I started by adding header X-Frame-Options : sameorigin. With this Our site cannot be loaded into any iframes hosted by any other sites, so Clickjacking part worked fine.</p>
  
  <p>Now the problem, we have few pages where we are using iframes to load hosted forms of payment gateway which is making use of iframeCommunicator Url option for cross domain communication. After adding X-Frame-Options header the hosted form is not communicating with the payment gateway.</p>
  
  <p>I am getting below error in console:
   Refused to display '<a href="http://localhost:44352/examplesite/payment/iFrameCommunicator#action=resizeWindow&amp;width=1106&amp;height=152" rel="nofollow noreferrer">http://localhost:44352/examplesite/payment/iFrameCommunicator#action=resizeWindow&amp;width=1106&amp;height=152</a>' in a frame because it set 'X-Frame-Options' to 'sameorigin'. </p>
  
  <p>The above error came for the header I set inside webconfig as below</p>
  
  <pre><code>&lt;httpProtocol&gt;
    &lt;customHeaders&gt;
        &lt;add name="X-FRAME-OPTIONS" value="SAMEORIGIN" /&gt;
    &lt;/customHeaders&gt;
  &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>Other settings that I have tried : </p>
  
  <pre><code>&lt;add name="X-Content-Security-Policy" value="frame-ancestors 'self' *.example.net*" /&gt; 
  
  &lt;add name="Content-Security-Policy" value="frame-ancestors 'self' *.example.net*" /&gt;
  </code></pre>
  
  <p>where <em>.example.net</em> is the payment gateway url used for fetching hosted form.</p>