{"action":"created","issue":{"url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/63","labels_url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/63/labels{/name}","comments_url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/63/comments","events_url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/63/events","html_url":"https://github.com/barryvdh/laravel-cors/issues/63","id":103916590,"number":63,"title":"The 'Access-Control-Allow-Origin' header contains multiple values","user":{"login":"emoh","id":11470841,"avatar_url":"https://avatars.githubusercontent.com/u/11470841?v=3","gravatar_id":"","url":"https://api.github.com/users/emoh","html_url":"https://github.com/emoh","followers_url":"https://api.github.com/users/emoh/followers","following_url":"https://api.github.com/users/emoh/following{/other_user}","gists_url":"https://api.github.com/users/emoh/gists{/gist_id}","starred_url":"https://api.github.com/users/emoh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/emoh/subscriptions","organizations_url":"https://api.github.com/users/emoh/orgs","repos_url":"https://api.github.com/users/emoh/repos","events_url":"https://api.github.com/users/emoh/events{/privacy}","received_events_url":"https://api.github.com/users/emoh/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-08-30T10:20:48Z","updated_at":"2015-11-05T13:37:08Z","closed_at":null,"body":"I'm using AngularJS App on the client side to access Laravel API hosted on IIS 8.5.It works fine when client is hosted on same domain.But when hosted on different domain it gives following error.\r\n\r\n```\r\nXMLHttpRequest cannot load http://example.com/api. The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost, *', but only one is allowed. Origin 'http://localhost' is therefore not\r\n```\r\n\r\nWeb.config:\r\n```\r\n<configuration>\r\n    <system.webServer>\r\n        <rewrite>\r\n            <rules>\r\n                <rule name=\"Imported Rule 1\" stopProcessing=\"true\">\r\n                    <match url=\"^(.*)/$\" ignoreCase=\"false\" />\r\n                    <conditions logicalGrouping=\"MatchAll\">\r\n                        <add input=\"{REQUEST_FILENAME}\" matchType=\"IsDirectory\" ignoreCase=\"false\" negate=\"true\" />\r\n                    </conditions>\r\n                    <action type=\"Redirect\" url=\"/{R:1}\" redirectType=\"Permanent\" />\r\n                </rule>\r\n                <rule name=\"Imported Rule 2\" stopProcessing=\"true\">\r\n                    <match url=\"^\" ignoreCase=\"false\" />\r\n                    <conditions logicalGrouping=\"MatchAll\">\r\n                        <add input=\"{REQUEST_FILENAME}\" matchType=\"IsDirectory\" ignoreCase=\"false\" negate=\"true\" />\r\n                        <add input=\"{REQUEST_FILENAME}\" matchType=\"IsFile\" ignoreCase=\"false\" negate=\"true\" />\r\n                    </conditions>\r\n                    <action type=\"Rewrite\" url=\"index.php\" />\r\n                </rule>\r\n            </rules>\r\n        </rewrite>\r\n        <httpProtocol>\r\n            <customHeaders>\r\n                <add name=\"Access-Control-Allow-Origin\" value=\"*\" />\r\n                <add name=\"Access-Control-Allow-Headers\" value=\"Origin, Content-Type, Authorization, Accept, X-Request-With\" />\r\n\t\t\t\t<add name=\"Access-Control-Allow-Methods\" value=\"GET, POST, PUT,  DELETE, OPTIONS\" />\r\n                <add name=\"Access-Control-Allow-Credentials\" value=\"true\" />\r\n            </customHeaders>\r\n        </httpProtocol>\r\n    </system.webServer>\r\n</configuration> \r\n````\r\nActual Response header:\r\n```\r\nRequest Method:POST\r\nStatus Code:200 OK\r\nAccess-Control-Allow-Credentials:true\r\nAccess-Control-Allow-Headers:Origin, Content-Type, Authorization, Accept, X-Request-With\r\nAccess-Control-Allow-Methods:GET, POST, PUT,  DELETE, OPTIONS\r\nAccess-Control-Allow-Origin:http://localhost\r\nAccess-Control-Allow-Origin:*\r\n```\r\nWhy 'Access-Control-Allow-Origin' echoed twice.\r\nWhat is the right way to host API on IIS? Do I have to include <customHeaders> headers in web.config file."},"comment":{"url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/comments/154060436","html_url":"https://github.com/barryvdh/laravel-cors/issues/63#issuecomment-154060436","issue_url":"https://api.github.com/repos/barryvdh/laravel-cors/issues/63","id":154060436,"user":{"login":"marcelorl","id":1603398,"avatar_url":"https://avatars.githubusercontent.com/u/1603398?v=3","gravatar_id":"","url":"https://api.github.com/users/marcelorl","html_url":"https://github.com/marcelorl","followers_url":"https://api.github.com/users/marcelorl/followers","following_url":"https://api.github.com/users/marcelorl/following{/other_user}","gists_url":"https://api.github.com/users/marcelorl/gists{/gist_id}","starred_url":"https://api.github.com/users/marcelorl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marcelorl/subscriptions","organizations_url":"https://api.github.com/users/marcelorl/orgs","repos_url":"https://api.github.com/users/marcelorl/repos","events_url":"https://api.github.com/users/marcelorl/events{/privacy}","received_events_url":"https://api.github.com/users/marcelorl/received_events","type":"User","site_admin":false},"created_at":"2015-11-05T13:37:08Z","updated_at":"2015-11-05T13:37:08Z","body":"Hmmmmm I got it.\r\n\r\nNp. When you figure out the problem I would love to know what was that.\r\n\r\nI think that it's ok you leave the test like that, (for a while), just to do more productive things.\r\n\r\n\r\nGood luck again =)."}}