#### [Abblix\.Oidc\.Server\.AspNetCore](https://www.abblix.com/en/docs/api/abblix-oidc-server-aspnetcore 'index')
### [Abblix\.Oidc\.Server\.AspNetCore](https://www.abblix.com/en/docs/api/abblix-oidc-server-aspnetcore/Abblix.Oidc.Server.AspNetCore 'Abblix\.Oidc\.Server\.AspNetCore')

## AntiFramingHeaders Class

Header values that forbid a self\-rendered HTML page \(such as the form\_post auto\-submit page\) from being
embedded in another origin's frame, defending against clickjacking as required by the OAuth 2\.0 Security
Best Current Practice \(RFC 9700, Section 4\.16\)\. Single source of truth shared by both transport adapters,
paired with the framework's `HeaderNames` constants for the header names at the call site\.

```csharp
public static class AntiFramingHeaders
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → AntiFramingHeaders
### Fields

## AntiFramingHeaders\.ContentSecurityPolicy Field {#Abblix.Oidc.Server.AspNetCore.AntiFramingHeaders.ContentSecurityPolicy}

Content\-Security\-Policy value that denies every framing ancestor\. Covers modern user agents\.

```csharp
public const string ContentSecurityPolicy = "frame-ancestors 'none'";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## AntiFramingHeaders\.XFrameOptions Field {#Abblix.Oidc.Server.AspNetCore.AntiFramingHeaders.XFrameOptions}

X\-Frame\-Options value that denies all framing\. Covers legacy user agents that predate CSP frame\-ancestors\.

```csharp
public const string XFrameOptions = "DENY";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')