ASP.Net Core: X-Frame-Options strange behavior
<p>I need to remove <code>X-Frame-Options: SAMEORIGIN</code> header from some of my actions which should render a content for an iframe. As long as it is added to requests by default I disabled it in <code>Startup.cs</code>: <code>services.AddAntiforgery(o =&gt; o.SuppressXFrameOptionsHeader = false);</code>. Then I wrote a simple middleware:</p>

<pre><code>    app.Use(async (context, next) =&gt;
    {
        context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");

        await next();
    });
</code></pre>

<p>Actions needed to answer to cross-domain requests are decorated with result filter attribute:</p>

<pre><code>    public class SuppresXFrameOptionFilter : ResultFilterAttribute
    {
        public override async Task OnResultExecutionAsync(ResultExecutingContext context,
ResultExecutionDelegate next)
        {
            context.HttpContext.Response.Headers.Remove("X-Frame-Options");

            await next();
        }
    }
</code></pre>

<p>Here comes the weiredness. First cross-domain request fails because despite the filter works as expected in the end the <code>X-Frame-Options: SAMEORIGIN</code> is still present in the response (I checked it after <code>next()</code> in the middleware - the header reappeared). If I press F5 the header is no longer in the response and everything works as it should. That happens only with <code>X-Frame-Options</code> header, a custom one is removed correctly.
What makes the <code>X-Frame-Options</code> which has been removed appear in a response again?</p>