AntiFramingHeaders Class

Header values that forbid a self-rendered HTML page (such as the form_post auto-submit page) from being embedded in another origin's frame, defending against clickjacking as required by the OAuth 2.0 Security Best Current Practice (RFC 9700, Section 4.16). Single source of truth shared by both transport adapters, paired with the framework's HeaderNames constants for the header names at the call site.

public static class AntiFramingHeaders

Inheritance System.Object → AntiFramingHeaders

Fields

AntiFramingHeaders.ContentSecurityPolicy Field

Content-Security-Policy value that denies every framing ancestor. Covers modern user agents.

public const string ContentSecurityPolicy = "frame-ancestors 'none'";

Field Value

System.String

AntiFramingHeaders.XFrameOptions Field

X-Frame-Options value that denies all framing. Covers legacy user agents that predate CSP frame-ancestors.

public const string XFrameOptions = "DENY";

Field Value

System.String