While trying to use HeaderNames.XFrameOptions, I found that it works in one of my projects and fails in another. Both are targeting .NET 6.
In my app, I need to work with the X-Frame-Options HTTP header. When possible, for maintainability reasons, I try to evade specifying constants for such standard strings myself, relying on standard constants instead. For this header's name, there is HeaderNames.XFrameOptions, available since ASP.NET Core 3.0.
By navigating to the class's implementation in VS, I found that the project where it works uses version 6.0.0.0 (.NET 6, x64) of the Microsoft.Net.Http.Headers assembly:
C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App\6.0.12\Microsoft.Net.Http.Headers.dll
The project where it does not work uses version 2.2.0.0 (.NET Standard 2.0, MSIL) of the assembly:
C:\Program Files\dotnet\sdk\NuGetFallbackFolder\microsoft.net.http.headers\2.2.0\lib\netstandard2.0\Microsoft.Net.Http.Headers.dll
The working project is the main project of my console app and the broken project is a library in the same solution, directly referenced by the console app.
When I looked into the broken project's obj\project.assets.json, I found that Microsoft.Net.Http.Headers is really used in version 2.2.0 and it is referenced by Microsoft.AspNetCore.Http.Extensions/2.2.0, which is also used in the broken project.
I used that info to reproduce the failure:
dotnet new globaljson --sdk-version 6.0.404 --roll-forward disable
dotnet new console -f net6.0
dotnet add package Microsoft.AspNetCore.Http.Extensions --version 2.2.0
echo "Console.WriteLine(Microsoft.Net.Http.Headers.HeaderNames.XFrameOptions);" > Program.cs
dotnet run
C:\Repos\playground\Program.cs(1,58): error CS0117: 'HeaderNames' does not contain a definition for 'XFrameOptions' [C:\Repos\playground\playground.csproj]
The build failed. Fix the build errors and run again.
I tried adding all the packages referenced by the working project to the repro project and it fixed it! By elimination and following the dependencies of the last remaining project, I found that the fix can be achieved by adding just a single package (AspNetCore.HealthChecks.UI.Client/6.0.5):
dotnet add package AspNetCore.HealthChecks.UI.Client --version 6.0.5
dotnet run
X-Frame-Options
I see that AspNetCore.HealthChecks.UI.Client references the Microsoft.Net.Http.Headers assembly version 6.0.0.0, but directly, as an assembly, not as a NuGet package. Sadly, the latest packaged version is 2.2.0.0.
How can I make HeaderNames.XFrameOptions work in both my projects at the same time? Is installing an irrelevant package like AspNetCore.HealthChecks.UI.Client the only solution? And is there a more straightforward way to diagnose such assembly resolution issues?
Between ASP.NET Core 2.2 and 3.0, the distribution model changed. Since .NET Core 3.0 and ASP.NET Core 3.0, the individual packages of the framework itself are no longer published, and the Microsoft.AspNetCore.App shared framework is supposed to be used instead.
The shared framework is referenced implicitly by the Microsoft.NET.Sdk.Web SDK.
For referencing the shared framework in class libraries and more generally in projects using a different SDK, use FrameworkReference:
This is recommended by the guidance for ASP.NET Core use in class libraries. When deciding whether to preserve compatibility with ancient ASP.NET Core 2.2 and older or whether to use new APIs, there is another guide.
When migrating from ASP.NET Core 2.2 or older to a newer one, follow the guide for migration from 2.2 to 3.0: remove the references to the old libraries and use FrameworkReference where appropriate.
While already using newer ASP.NET Core, take care not to add references to the NuGet packages of ASP.NET Core 2.2. Strangely, the old packages are not marked as deprecated.
More reading on FrameworkReference:
Closely related questions: