I'm trying to load an IFrame on my website, but I'm getting the dreaded Refused to display 'url' in a frame because it set 'X-Frame-Options' to 'sameorigin'. However, when I look at the actual reponse headers sent from the other website I can't find a single occurance of X-Frame-Options!
Why does Chrome complain that the header is set when I can't find it in DevTools?
The URL of the site I'm trying to embedd is a https://localhost:44359 and it is running an ASP.NET Core MVC instance.
I tried adding some middleware to it to remove this header, but seeing as the header is never set there is also nothing to remove... unless, of course, this is set by MVC itself, in which case no middleware will help because MVC terminates the middleware pipeline.
I guess I could set a <meta> tag on the page itself, but even Google says that X-Frame-Options Allow-From is not supported and I found an article (unfortunaly can't find it again) that said Google would be using Content Security Policy for this instead. I tried adding frame-src https://localhost:44359 to the CSP for the site that is trying to embed an iframe, but that had no effect.
Is there any way of "forcing" Chrome (et al) to accept an iframe from localhost?