title: Access-Control-Allow-Origin appearing twice on header request ASP.NET Web API
body: <p>One one of my ASP.NET Web API controllers. I am getting the following error returned on my client application: </p>
  
  <blockquote>
    <p>Response to preflight request doesn't pass access control check: The
    'Access-Control-Allow-Origin' header contains multiple values '*, *',
    but only one is allowed. Origin '<a href="http://localhost:8100" rel="noreferrer">http://localhost:8100</a>' is therefore
    not allowed access.</p>
  </blockquote>
  
  <p>I recognise that this error occurs because the header contains multiple values. I can see this in the  'Response Headers' when the call is made to the API via Chrome, it looks like this: </p>
  
  <blockquote>
    <p>HTTP/1.1 200 OK</p>
    
    <p>Cache-Control: no-cache</p>
    
    <p>Content-Length: 0</p>
    
    <p>Server: Microsoft-IIS/8.0</p>
    
    <p>Access-Control-Allow-Methods: GET, POST</p>
    
    <p>Access-Control-Allow-Origin: *</p>
    
    <p>Access-Control-Allow-Headers: Content-Type, Accept, Pragma,
    Cache-Control, Authorization</p>
    
    <p>Access-Control-Max-Age: 1728000</p>
    
    <p>X-Powered-By: ASP.NET</p>
    
    <p>Access-Control-Allow-Origin: *</p>
    
    <p>Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE</p>
    
    <p>Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type,
    Accept, Authorization</p>
    
    <p>Set-Cookie:
    ARRAffinity=ef9b3770b61f10f9696b0dedcb39a7f47a83c0e4d6cdbf367f3149482592ef06;Path=/;HttpOnly;Domain=seirse.azurewebsites.net</p>
  </blockquote>
  
  <p>As you can see, it's clearly there twice. </p>
  
  <p>The problem I have is that the only place I have enabled CORS is via the web.config in my application, e.g. </p>
  
  <pre><code>&lt;httpProtocol&gt;
        &lt;customHeaders&gt;
          &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
          &lt;add name="Access-Control-Allow-Methods" value="GET, POST, OPTIONS, PUT, DELETE" /&gt;
          &lt;add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept, Authorization" /&gt;
        &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>I have made 100% sure that I have not enabled CORS via Startup.cs nor in the controller either. </p>
  
  <p>There is nothing out of the ordinary with the controller as far as I can see: </p>
  
  <pre><code>// GET: api/Address/all
  [HttpGet]
  public AddressResultModel All()
  {
      try
      {
          var userId = _accountService.GetUserId(Request);
          return _customerRepository.GetAddresses(userId);
      }
      catch (Exception)
      {
          return null;
      }
  }
  </code></pre>
  
  <p>Any ideas what the problem might be? </p>