3

I have a wcf web service application running from IIS Express in VS 2015 that needs to allow cross origin requests. Initially I got a "Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:1234' is therefore not allowed access." message from my client app. I added a Global.asax with the following code

protected void Application_BeginRequest(object sender, EventArgs e)
    {
        // Ensure the web service allows cross site scripting from certain origins

        HttpContext.Current.Response.AddHeader("Access-Control-Allow-Origin", "http://localhost:1234");
        if (HttpContext.Current.Request.HttpMethod == "OPTIONS")
        {
            HttpContext.Current.Response.AddHeader("Access-Control-Allow-Methods", "POST, PUT, OPTIONS");

            //HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type, Accept");
            HttpContext.Current.Response.AddHeader("Access-Control-Allow-Headers", "Content-Type");
            HttpContext.Current.Response.AddHeader("Access-Control-Max-Age", "1728000");
            HttpContext.Current.Response.End();
        }
    }

Now when I try to call the service from my client I get "The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost:1234, *', but only one is allowed. Origin 'http://localhost:1234' is therefore not allowed access."

So no header is not enough, but one header is turning into two. Why does this happen?

Note: I don't have anything in the web.config that would add any headers

<customHeaders>
   <add name="Access-Control-Allow-Origin" value="*" />
 </customHeaders>
nickvans
  • 898
  • 13
  • 24
  • 1
    Just putting a comment as this isn't a real answer but I had the same problem and searching 'CORS' in my solution + debugging enabled me to remove them. Server to server requests were fine, but ajax calls from another domain had these duplicate headers. I ended up ctrl+shift+f searching CORS in my solution and found that in Thinktecture's Identity Server 2 CORS config was already setup, but in my Register method in WebApiConfig it was being setup again. Commenting out the second removed the duplicates. Also inspected packages as duplicate CORS packages can cause this. – Sean Sherman Oct 04 '17 at 21:08

0 Answers0