title: Getting an "X-frame-options is set to Deny" when I don't have the setting in my web.config
body: <p>We have an IIS7 website page that is accessed via a third-party website through an iframe. It's been working fine up until a few days ago with the following error from Chrome:</p>
  
  <blockquote>
    <p>Refused to display '<a href="https://xxxxxxxx" rel="nofollow noreferrer">https://xxxxxxxx</a>' in a frame because it set
    'X-Frame-Options' to 'deny'.</p>
  </blockquote>
  
  <p>Edge reports a slightly different error, but in essence, it reports not being able to access fonts on that target website.</p>
  
  <p>Now I've checked the <code>web.config</code> file and there is no custom header with the 'x-frame-options' set anywhere, but we do have the 'x-xss-protection' header that is set to '1; mode=block'. I've tried removing the block </p>
  
  <p><code>X-XSS-Protection 1;</code> </p>
  
  <p>but then I get:</p>
  
  <blockquote>
    <p>Failed to load resource: the server responded with a status of 400
    (Bad Request)</p>
  </blockquote>
  
  <p>I also remove the entire x-xss header entirely, which takes me back to the original message. I then manually add in </p>
  
  <pre><code>X-Frame-Options Allow-From https://xxxxxx
  </code></pre>
  
  <blockquote>
    <p>Refused to display '<a href="https://xxxxxx" rel="nofollow noreferrer">https://xxxxxx</a>' in a frame because it set multiple
    'X-Frame-Options' headers with conflicting values ('DENY, allow-from
    <a href="https://xxxxxx" rel="nofollow noreferrer">https://xxxxxx</a>'). Falling back to 'deny'.</p>
  </blockquote>
  
  <p>Any ideas where the x-frame-options Deny is coming from? I've loaded web.config into an editor and it definitely does not find that header in there.</p>
  
  <p>Courtesy of Lex Li, I have turned on Failed Request Tracing and have found this in the logs: </p>
  
  <p><a href="https://i.stack.imgur.com/QXLib.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QXLib.png" alt="enter image description here"></a></p>
  
  <p>But where is it referencing the x-frame-options from? The Set-Cookie header is also not existing in my web.config, so it must be elsewhere.</p>
  
  <p>Thanks</p>