title: IE9 X-Frame-Options deny upload
body: <p>I'm in a big trouble here. I got a .Net MVC 4 application that uses Kendo UI as layout base and for upload too. The upload works fine on all browsers except on an IE9 (9.0) running on a <code>Windows Server 2008 RC2 x64</code> - <em>I don't really know if those info are important</em>.</p>
  
  <p>It gives me the error <code>SCRIPT5: Access Denied</code> when Kendo tries to send the async call. According to <a href="http://www.kendoui.com/forums/ui/upload/custom-authorization-header-for-upload.aspx#JLqCFZ8kl0CB9GBhVEWQlA" rel="nofollow">this post</a> of a Telerik's Member in kendo UI Foruns, Kendo creates an <code>iframe</code> to make async uploads possible on prior versions to IE10.</p>
  
  <p>I tryied adding a header on webconfig of the api:</p>
  
  <pre><code>&lt;customHeaders&gt;
      &lt;add name="Access-Control-Allow-Credentials" value="true" /&gt;
      &lt;add name="X-Frame-Options" value="ALLOW-FROM *"/&gt;
  &lt;/customHeaders&gt;
  </code></pre>
  
  <p><em>The other headers for <code>CORS</code> are implicity set on a <code>CORS Handler Class</code> like <a href="http://blogs.msdn.com/b/carlosfigueira/archive/2012/02/20/implementing-cors-support-in-asp-net-web-apis.aspx" rel="nofollow">this</a> on api.</em></p>
  
  <p>So I can see that header on the Response Headers on the IE request, so IE do retrieves it. I don't know the support - speciallly in IE - for the value <a href="https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options" rel="nofollow"><code>ALLOW-FROM</code></a> neither if it accepts <code>*</code>. But I tried using <code>SAMEORIGIN</code> value for that header and it doesn't worked and I have reason for it: <strong>My WebApi isn't on the same address as the Front-End.</strong> They're at different servers and addesses. The upload is sent directly to the Api on this url:</p>
  
  <p><code>http://dev.******.com/webserviceapi/api/UserProfile/Upload</code></p>
  
  <p>And the Front-End is in:</p>
  
  <p><code>http://dev.******.com/portal/</code></p>
  
  <p><em>The supressed content in url are the same for both addresses.</em></p>
  
  <p>So I have no ideia how to achieve this. This error doesn't fit anything I've found on web. Any help will be very appreciated!! Thank you in advance.</p>