title: Removing X-Frame-Options being added automatically only in Login page
body: <p>I am developing an ASP.NET MVC application which needs to be loaded inside an <code>iframe</code> in another website. But the login page just won't appear inside the <code>iframe</code> because an Header is being sent in the response <code>X-Frame-Options</code> which is set to <code>SAMEORIGIN</code>. Browser is not displaying the page in <code>iframe</code> because of this. I already Googled and tried multiple things but nothing worked.</p>
  
  <p>I am using ASP.NET forms authentication. May be in this case IIS adds this header in login page for added security. But I need to get rid of this in my use case.</p>
  
  <p>I tried adding a custom header</p>
  
  <pre><code>&lt;httpProtocol&gt;
    &lt;customHeaders&gt;
      &lt;add name="X-Frame-Options" value="ALLOW" /&gt;
    &lt;/customHeaders&gt;
  &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>But the <code>SAMEORGIN</code> is still being added in the header with comma.</p>
  
  <p>I also tried adding Header value from C# using <code>Response.Headers["X-Frame-Options"] = "ALLOW"</code>. It cause two headers with the same name.</p>
  
  <p>I also tried this in web.config</p>
  
  <pre><code>&lt;customHeaders&gt;
      &lt;remove name="X-Frame-Options" /&gt;
  &lt;/customHeaders&gt;
  </code></pre>
  
  <p>It also didn't worked.</p>