remove XFO from end session callback iframe #1224

IdentityServer · Aug 5, 2017 · 3190c90 · 3190c90
1 parent b534238
commit 3190c90
Showing 1 changed file with 0 additions and 17 deletions.
diff --git a/src/IdentityServer4/Endpoints/Results/EndSessionCallbackResult.cs b/src/IdentityServer4/Endpoints/Results/EndSessionCallbackResult.cs
@@ -55,7 +55,6 @@ public async Task ExecuteAsync(HttpContext context)
             else
             {
                 context.Response.SetNoCache();
-                AddXfoHeaders(context);
                 AddCspHeaders(context);
 
                 var html = GetHtml();
@@ -92,22 +91,6 @@ private void AddCspHeaders(HttpContext context)
             }
         }
 
-        private void AddXfoHeaders(HttpContext context)
-        {
-            if (!context.Response.Headers.ContainsKey("X-Frame-Options"))
-            {
-                var logoutPageUrl = _options.UserInteraction.LogoutUrl;
-                if (logoutPageUrl.IsLocalUrl())
-                {
-                    context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
-                }
-                else
-                {
-                    context.Response.Headers.Add("X-Frame-Options", $"ALLOW-FROM {logoutPageUrl.GetOrigin()}");
-                }
-            }
-        }
-
         string GetHtml()
         {
             string framesHtml = null;