Removing "X-Frame-Options" header for a specific controller only
<p>I am trying to remove the "X-Frame-Options" header for only a specific controller's actions using:</p>

<pre><code>protected override void OnResultExecuting(ResultExecutingContext filterContext)
{
    filterContext.HttpContext.Response.Headers.Remove("X-Frame-Options");
    base.OnResultExecuting(filterContext);
}
</code></pre>

<p>However, that doesn't seem to work at all.  The only way I can get it to work at all on my site is to add this code to the global.asax below.  I am pretty sure I am missing the correct step in the ASP.NET MVC / IIS pipeline that allows me to overwrite the IIS setting of that header.  Is this possible?</p>

<pre><code>protected void Application_EndRequest()
{
    Response.Headers.Remove("X-Frame-Options");
}
</code></pre>

<p>As for why I want to do this, I am building a widget that user's will be able to use on their personal sites through the use of an iframe, but allow them to post back information to our site.  I realize there are security implications to turning this header off, and while I welcome any suggestions on how to mitigate those risks, I just want to know if what I am asking is possible.</p>