title: 'Access-Control-Allow-Origin' header contains multiple values - nginx + sails.js
body: <p>I'm going across two domains using Chrome browser:</p>
  
  <ul>
  <li>client:    <a href="http://vb.localhost:909" rel="nofollow">http://vb.localhost:909</a> (angular.js)</li>
  <li>backend:   <a href="http://db.localhost:909/matches" rel="nofollow">http://db.localhost:909/matches</a> (sails.js, node app on port 1337)</li>
  </ul>
  
  <p>everything is served by nginx.</p>
  
  <p>I get the following error:</p>
  
  <p>XMLHttpRequest cannot load <a href="http://db.localhost:909/matches" rel="nofollow">http://db.localhost:909/matches</a>. <strong>The 'Access-Control-Allow-Origin' header contains multiple values ', *', but only one is allowed.</strong> Origin '<a href="http://vb.localhost:909" rel="nofollow">http://vb.localhost:909</a>' is therefore not allowed access. </p>
  
  <p>Here's the nginx.conf for both server blocks:</p>
  
  <pre><code> server {
     listen       909;
     server_name  vb.localhost;     
  
     location / {
         root   "\apps\vb-site\UI\dev";
         index  index.html;
     }
  }
  server {
     listen 909;
     server_name  db.localhost;
     add_header Access-Control-Allow-Origin *;
  
     location / {
      proxy_pass http://127.0.0.1:1337;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Host $host;
      proxy_cache_bypass $http_upgrade;
  
     }
  </code></pre>
  
  <p>}</p>
  
  <p>In the sails.js app, in the config/cors.js file, I've allowed all domains CORS access:</p>
  
  <pre><code> origin: '*',
  </code></pre>
  
  <p>It looks like a blank domain is being added before the wildcard '*' is added in the db.localhost server block of nginx since the error in Chrome is: <strong>', *'</strong> &lt;- notice the empty char, then commma, then * (wildcard)</p>
  
  <p>Where am I going wrong in the configuration?</p>