title: The 'Access-Control-Allow-Origin' Header Contains Multiple Values. However I Only Have One Value Defined in the Header?
body: <p>The following error throws for me when making a request:</p>
  
  <pre><code>Access to XMLHttpRequest at 'My Server URL' from origin 'Server Name' has been 
  blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple
  values 'Server Name, *', but only one is allowed.
  </code></pre>
  
  <p>However in my WebApiConfig.cs file I have defined the CORS policy as follows:</p>
  
  <pre><code>var cors = new EnableCorsAttribute("MyServerName", "Content-Type", "GET,PUT,POST,DELETE");
  config.EnableCors(cors);
  </code></pre>
  
  <p>I have defined only one value <em>MyServerName</em>, yet the error thrown defines it as <code>'Server Name, *'</code></p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>When disabling my CORS definition in my WebApiConfig.cs file I recieve the following error when making a request:</p>
  
  <pre><code>Access to XMLHttpRequest at 'My Server URL' from origin 'Server Name' has been 
  blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in
  the response must not be the wildcard '*' when the request's credentials mode is
  'include'. The credentials mode of requests initiated by the XMLHttpRequest is 
  controlled by the withCredentials attribute.
  </code></pre>
  
  <p>I do not have CORS defined in my Web.config file.</p>
  
  <p><strong>UPDATE 2</strong></p>
  
  <p>My Access-Control-Allow-Origin value was being defined in my IIS, after changing it and running it, it thinks the value is ''.</p>