title: enable cors on iis - load denied by x-frame-options: does not permit cross-origin framing
body: <p>There are several questions about that but I couldn't get the right answer yet. I give a short summary:</p>
  
  <p>Company A has a website with an iframe in it. Company B gives the URL for that iframe. The user uses an application from Company B and with the settings the user chooses it sets up an URL which is delivered to the iframe from Company A.</p>
  
  <p>However, the framing is not working yet because of x-frame-options. The error message is the following:</p>
  
  <blockquote>
    <p>Load denied by X-Frame-Options:
    <a href="http://www.myurl.com:8088/myPath?panel=panel&amp;user=username" rel="nofollow noreferrer">http://www.myurl.com:8088/myPath?panel=panel&amp;user=username</a>
    does not permit cross-origin framing.</p>
  </blockquote>
  
  <p>I added</p>
  
  <pre><code>&lt;httpProtocol&gt;
      &lt;customHeaders&gt;
          &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
      &lt;/customHeaders&gt;
  &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>to my web.config and also tried to add</p>
  
  <pre><code>&lt;handlers&gt;  
      &lt;remove name="OPTIONS"/&gt;
  &lt;/handlers&gt;
  </code></pre>
  
  <p>without any success.</p>
  
  <p>I got that suggestions from <a href="https://enable-cors.org/server_iis7.html" rel="nofollow noreferrer">this</a> and <a href="http://blog.aminjam.com/cors-support-for-iis8/" rel="nofollow noreferrer">this</a> website to add CORS support on my IIS. As I mentioned above, without any success. I'm not that good in web development or IIS so maybe this question sounds stupid to you: Does Company A has to enable CORS or does Company B? Or both? And how? The suggestions I got from google didn't help yet.</p>
  
  <p>Suggestions appreciated.</p>