Refused to display 'https://mytestwebsite.com/?wa=wsignoutcleanup1.0' in a frame because it set 'X-Frame-Options' to 'DENY' - asp.net-mvc-2

Question

I am using ADFS 2.0 as authentication process for the application which is developed using asp.net mvc2 and SQL Server 2012. In order to resolve the issue: Clickjacking (aka Cross-Site Framing or XSF), we have set the X-Frame-Options with value DENY in the web.config file.
Steps to reproduce:
1. Logged into the application using valid credentials using Chrome browser.
2. System displayed me the application landing page.
3. Clicked F12 to open the Developer Tools options.
4. Now clicked on Signout option and navigated to the Console window.
5. System displayed the ADFS Signout page, but still I am getting an error in the Console window as mentioned below:
Refused to display 'https://mytestwebsite.com/?wa=wsignoutcleanup1.0' in a frame because it set 'X-Frame-Options' to 'DENY'.
On checking the ViewSource of the ADFS Sognout page I came to see the following:
<iframe class="Test" src="https://mytestwebsite.com/?wa=wsignoutcleanup1.0">
</iframe>
Can anyone suggest me the best possible ways to resolve the above issue?

Answer 1

One option is to do nothing. The important part of the sign-out cleanup is to remove the authentication cookie for mytestwebsite.com which still gets done, because the http header is still processed, even if the resulting iframe content is not displayed.
Allowing the iframe content to render is only important if:
Your web application performs further down-stream signout cleanup. I.e. it contains its own iframe tags to signout other applications, or
Your STS uses <img> tags instead of iframes for sign-out cleanup, and you want the green tick image that WIF returns to appear, or
You really, really don't want that harmless error message appearing in your browser console.
If it really is necessary, you can add x-frame-options DENY to all responses except WS-federation signout cleanup programmatically.
For an ASP.NET MVC application, you can use (in Global.asax.cs):
public override void Init()
{
base.Init();
FederatedAuthentication.WSFederationAuthenticationModule.SigningOut += this.WSFederationAuthenticationModuleOnSigningOut;
}
protected void Application_BeginRequest(object sender, EventArgs e)
{
Response.Headers["X-Frame-Options"] = "DENY";
}
private void WSFederationAuthenticationModuleOnSigningOut(object sender, SigningOutEventArgs args)
{
if (args.IsIPInitiated)
{
Response.Headers.Remove("X-Frame-Options");
}
}