c# - Allow frame from different domain with MVC5 -

i trying load google maps iframe using mvc5 getting blocked error

refused display 'https://www.google.com/maps?cid=xxxxx' in frame because set 'x-frame-options' 'sameorigin'.

so after searching, have tried following:

• adding antiforgeryconfig.suppressxframeoptionsheader = true; application_start in global.ascx

• creating attribute (have tried , without setting in global.ascx):

  public override void onactionexecuted(actionexecutedcontext filtercontext) {     if (filtercontext != null)     {         filtercontext.httpcontext.response.headers["x-frame-options"] = "allow-from https://www.google.com";         base.onactionexecuted(filtercontext);     } } 

• trying attribute onresultexecuted(resultexecutedcontext filtercontext) instead of onactionexecuted

• remove in web.config:

  <httpprotocol>     <customheaders>         <remove name="x-frame-options" />     </customheaders> </httpprotocol> 

is there i'm missing? how rid of http header (or @ least change allow maps)?

update

i have checked headers being sent , correct in either

x-frame-options: allow-from https://www.google.com

or aren't there @ if remove attribute keep global.ascx update

yet when run page , see these headers, still giving me sameorigin error.

as turns out have been stupid , misunderstood how x-frame-options work. stop site page being shown on site through iframe.

so x-frame-options http header getting sameorigin coming google. thought url returned places api use it, apparently can link it.

creating new map api key , enabling maps embed api, able use place_id instead , call following url iframe:

https://www.google.com/maps/embed/v1/place?key=your_api_key&q=place_id:place_id 

and show without me getting header (or doing headers).

i'll leave here in case daft am