title: Getting error: 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed
body: <p>I tried to make a connection between my Angular frontend and a REST Endpoint in Java / Spring (which I didn't developed and don't know so well). By GET, all works. By POST, I receive the message in the terminal</p>
  <blockquote>
  <p>has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.</p>
  </blockquote>
  <p>and, in the Network tab from the dev instruments, an error 403 on OPTIONS method</p>
  <pre><code>Request Method: OPTIONS
  Status Code: 403 
  Remote Address: xx.xx.xx.xx:xxxx
  Referrer Policy: strict-origin-when-cross-origin
  </code></pre>
  <p>So, I found this case after several searching in internet and the cause is CORS settings: usually, in this scenario, a OPTIONS call is sent before a POST; but, due to CORS, an OPTIONS call is not allowed. So, I tried to set this row on my controller</p>
  <pre><code>@CrossOrigin(origins = &quot;*&quot;, methods = {RequestMethod.OPTIONS, RequestMethod.GET, RequestMethod.POST, RequestMethod.PUT, RequestMethod.DELETE})
  </code></pre>
  <p>This time the error changed in</p>
  <pre><code>Multiple CORS header 'Access-Control-Allow-Origin' not allowed
  But the code I added is the only similar to @CrossOrigin, I dind't found others similar.
  </code></pre>
  <p>So, in according to the post <a href="https://stackoverflow.com/questions/42016126/cors-issue-no-access-control-allow-origin-header-is-present-on-the-requested">CORS issue - No &#39;Access-Control-Allow-Origin&#39; header is present on the requested resource</a>, I tried the following solution:</p>
  <pre><code>@Configuration
  public class WebConfig extends WebMvcConfigurerAdapter {
  
      @Override
      public void addCorsMappings(CorsRegistry registry) {
          registry.addMapping(&quot;/**&quot;)
                  .allowedMethods(&quot;HEAD&quot;, &quot;GET&quot;, &quot;PUT&quot;, &quot;POST&quot;, &quot;DELETE&quot;, &quot;PATCH&quot;);
      }
  }
  </code></pre>
  <p>and</p>
  <pre><code>@Configuration
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  //        http.csrf().disable();
          http.cors();
      }
  
      @Bean
      public CorsConfigurationSource corsConfigurationSource() {
          final CorsConfiguration configuration = new CorsConfiguration();
          configuration.setAllowedOrigins(ImmutableList.of(&quot;*&quot;));
          configuration.setAllowedMethods(ImmutableList.of(&quot;HEAD&quot;,
                  &quot;GET&quot;, &quot;POST&quot;, &quot;PUT&quot;, &quot;DELETE&quot;, &quot;PATCH&quot;));
          // setAllowCredentials(true) is important, otherwise:
          // The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
          configuration.setAllowCredentials(true);
          // setAllowedHeaders is important! Without it, OPTIONS preflight request
          // will fail with 403 Invalid CORS request
          configuration.setAllowedHeaders(ImmutableList.of(&quot;Authorization&quot;, &quot;Cache-Control&quot;, &quot;Content-Type&quot;));
          final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
          source.registerCorsConfiguration(&quot;/**&quot;, configuration);
          return source;
      }
  }
  </code></pre>
  <p>But this time the error I see in the console became</p>
  <blockquote>
  <p>has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed.</p>
  </blockquote>
  <p>So, this is the last point I reached. How can I solve this last error about multiple values? Each time I work on this, I do a step ahead and the error changes but it is still there.</p>