ASP.NET MVC: Programmatically set HTTP headers on static content

Question

I have an ASP.NET application with a filter wired up in RegisterGlobalFilters that performs the following:

public class XFrameOptionsAttribute : ActionFilterAttribute
{
    public override void OnResultExecuting(System.Web.Mvc.ResultExecutingContext filterContext)
    {
        filterContext.HttpContext.Response.AddHeader("X-FRAME-OPTIONS", "SAMEORIGIN");
    }
}

Looking in Fiddler, I can see that views returned from the webserver include this header. Static files however, such as JavaScript do not include this header in the HTTP response.

How do I get ASP.NET MVC to also apply this filter to any static files the web server returns?

This has nothing to do with web API filters @DeblatonJean-Philippe — Tommy
– Tommy, Commented Jan 22, 2016 at 18:18

ramiramilu · Accepted Answer · 2016-01-22 18:42:26Z

22

One way to set headers for all the content of site is in web.config. The customHeaders section will make sure that this header is included for all files and responses.

  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="X-FRAME-OPTIONS" value="SAMEORIGIN" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>

Another option is to create custom HttpModule as shown below. This way you have more control on the files and content to which headers needs to be appended.

namespace MvcApplication1.Modules
{
    public class CustomOriginHeader : IHttpModule
    {
        public void Init(HttpApplication context)
        {
            context.PreSendRequestHeaders += OnPreSendRequestHeaders;
        }

        public void Dispose() { }

        void OnPreSendRequestHeaders(object sender, EventArgs e)
        {
            // For example - To add header only for JS files
            if (HttpContext.Current.Request.Url.ToString().Contains(".js"))
            {
                HttpContext.Current.Response.Headers.Add("X-FRAME-OPTIONS", "SAMEORIGIN");
            }
        }
    }
}

And then register them in web.config as shown below -

  <system.webServer>
     <modules>
        <add name="CustomHeaderModule" type="MvcApplication1.Modules.CustomOriginHeader" />
     </modules>
  </system.webServer>

edited Jan 22, 2016 at 18:42

answered Jan 22, 2016 at 18:14

ramiramilu

17.2k6 gold badges51 silver badges66 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

codechurn Over a year ago

I have thought about doing this, but what if I have a scenario where I want to add a specific header to only certain static files.

ramiramilu Over a year ago

I also updated my answer with programmatic way to add headers, check it out.

Tommy · Accepted Answer · 2016-01-22 18:15:26Z

5

This is something that if you want on every request (static or dynamic requests), you should probably set it up through IIS (the web server). Here are some details on different ways that you can achieve this - http://www.iis.net/configreference/system.webserver/httpprotocol/customheaders

In short, you could do this in your web.config file

<configuration>
   <system.webServer>
      <httpProtocol>
         <customHeaders>
            <add name="X-Custom-Name" value="MyCustomValue" />
         </customHeaders>
      </httpProtocol>
   </system.webServer>
</configuration>

If you have access directly to IIS, you can use the UI to set this up as well.

answered Jan 22, 2016 at 18:15

Tommy

39.9k10 gold badges93 silver badges125 bronze badges

Collectives™ on Stack Overflow

ASP.NET MVC: Programmatically set HTTP headers on static content

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related