title: ASP.Net Core: X-Frame-Options strange behavior
body: <p>I need to remove <code>X-Frame-Options: SAMEORIGIN</code> header from some of my actions which should render a content for an iframe. As long as it is added to requests by default I disabled it in <code>Startup.cs</code>: <code>services.AddAntiforgery(o =&gt; o.SuppressXFrameOptionsHeader = false);</code>. Then I wrote a simple middleware:</p>
  
  <pre><code>    app.Use(async (context, next) =&gt;
      {
          context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
  
          await next();
      });
  </code></pre>
  
  <p>Actions needed to answer to cross-domain requests are decorated with result filter attribute:</p>
  
  <pre><code>    public class SuppresXFrameOptionFilter : ResultFilterAttribute
      {
          public override async Task OnResultExecutionAsync(ResultExecutingContext context,
  ResultExecutionDelegate next)
          {
              context.HttpContext.Response.Headers.Remove("X-Frame-Options");
  
              await next();
          }
      }
  </code></pre>
  
  <p>Here comes the weiredness. First cross-domain request fails because despite the filter works as expected in the end the <code>X-Frame-Options: SAMEORIGIN</code> is still present in the response (I checked it after <code>next()</code> in the middleware - the header reappeared). If I press F5 the header is no longer in the response and everything works as it should. That happens only with <code>X-Frame-Options</code> header, a custom one is removed correctly.
  What makes the <code>X-Frame-Options</code> which has been removed appear in a response again?</p>