title: X-Frame-Options Allow-From multiple domains
body: <p>I have an ASP.NET 4.0 IIS7.5 site which I need secured using the X-Frame-Options header.</p>
  
  <p>I also need to enable my site pages to be iframed from my same domain as well as from my facebook app.</p>
  
  <p>Currently I have my site configured with a site headed of:</p>
  
  <pre><code>Response.Headers.Add("X-Frame-Options", "ALLOW-FROM SAMEDOMAIN, www.facebook.com/MyFBSite")
  </code></pre>
  
  <p>When I viewed my Facebook page with Chrome or Firefox my sites pages (being iframed with my facebook page) are display ok, but under IE9, I get the error: </p>
  
  <blockquote>
    <p>"this page cannot be displayed…" (because of the <code>X-Frame_Options</code> restriction).</p>
  </blockquote>
  
  <p>How do I set the <code>X-Frame-Options: ALLOW-FROM</code> to support more than a single domain?</p>
  
  <p><code>X-FRAME-OPTION</code> being a new feature seems fundamentally flawed if only a single domain can be defined.</p>