title: Access-Control-Allow-Origin header contains multiple values *, *
body: <p>I'm building REST Web Service using c#.</p>
  
  <p>The I have a web application that is installed in another server. If I try to call any of these web services, I get this error</p>
  
  <blockquote>
    <p>Access to XMLHttpRequest at '<a href="https://test.domain.com/WS/Hab-Dem/Tar/api/Login" rel="nofollow noreferrer">https://test.domain.com/WS/Hab-Dem/Tar/api/Login</a>' from origin '<a href="https://std.apps.com" rel="nofollow noreferrer">https://std.apps.com</a>' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed.</p>
  </blockquote>
  
  <p>I have created this file:</p>
  
  <pre><code>public class PreflightRequestsHandler : DelegatingHandler
  {
      protected override Task&lt;HttpResponseMessage&gt; SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
      {
          if (request.Headers.Contains("Origin") &amp;&amp; request.Method.Method.Equals("OPTIONS"))
          {
              var response = new HttpResponseMessage { StatusCode = HttpStatusCode.OK };
  
              // Define and add values to variables: origins, headers, methods (can be global) 
              response.Headers.Add("Access-Control-Allow-Origin", "*");
              response.Headers.Add("Access-Control-Allow-Headers", "Content-Type");
              response.Headers.Add("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
              response.Headers.Add("Access-Control-Request-Headers", "*");
  
              var tsc = new TaskCompletionSource&lt;HttpResponseMessage&gt;();
              tsc.SetResult(response);
  
              return tsc.Task;
          }
  
          return base.SendAsync(request, cancellationToken);
      }
  }
  </code></pre>
  
  <p>In <code>WebApiConfig.cs</code> I have inserted this code:</p>
  
  <pre><code>public static void Register(HttpConfiguration config)
  {
      // Web API configuration and services
      config.EnableCors(new EnableCorsAttribute("*", "*", "*", "X-Custom-Header"));
      config.MessageHandlers.Add(new PreflightRequestsHandler()); // Defined above
      config.MapHttpAttributeRoutes();
  
      config.Routes.MapHttpRoute(
                  name: "DefaultApi",
                  routeTemplate: "api/{controller}/{id}",
                  defaults: new { id = RouteParameter.Optional } );
  
      var jsonConfig = config.Formatters.JsonFormatter;
      jsonConfig.SerializerSettings.NullValueHandling = NullValueHandling.Ignore;
  }
  </code></pre>
  
  <p>And in <code>web.config</code> file I have added this:</p>
  
  <pre><code>&lt;system.webServer&gt;
      &lt;handlers&gt;
          &lt;remove name="ExtensionlessUrlHandler-Integrated-4.0" /&gt;
          &lt;remove name="OPTIONSVerbHandler" /&gt;
          &lt;remove name="TRACEVerbHandler" /&gt;
          &lt;add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" 
               type="System.Web.Handlers.TransferRequestHandler" 
               preCondition="integratedMode,runtimeVersionv4.0" /&gt;
      &lt;/handlers&gt;
  &lt;/system.webServer&gt;
  </code></pre>