# CORS Error : header contains multiple values '\*, \*', but only one is allowed

**URL:** <https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334>\
**Category:** Apigee\
**Tags:** api-runtime\
**Created:** [June 8, 2015, 3:41pm UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334 "2015-06-08T15:41:22Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [June 8, 2015, 3:41pm UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/1 "2015-06-08T15:41:22Z")

</div>

Hi All,

I am getting “The ‘Access-Control-Allow-Origin’ header contains multiple values ‘\*, \*’, but only one is allowed.” type of error when requesting an API via ApiGee.

I have added an ApiGee policy of AssignMessage,

Add CORS

 \* 

true

and having PreFlow Response as,

add-cors

Am I missing anything? please help me out ☹

@Michael Malloy

@Gaurav Vishwas Joshi

@Dave Newman

@Barahalikar Siddharth

@Maruti Chand

@mukundha@apigee.com

@Hasan Otuome

@Scott Ganyo

@Mohsen Azimi

@all

---

<div class="post-metadata">

**Author:** ![ceber](https://avatars.discourse-cdn.com/v4/letter/c/bb73d2/32.png) [@ceber](https://discuss.google.dev/u/ceber)\
**Post date:** [June 8, 2015, 3:47pm UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/2 "2015-06-08T15:47:31Z")

</div>

Instead of using Add to set the Access-Control-Allow-Origin header, use Set. Since headers can support multiple values, Add will add one, rather than just setting the existing. Set will ensure that if there is already a header there you aren’t doubling it up.

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [June 8, 2015, 3:52pm UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/3 "2015-06-08T15:52:08Z")

</div>

Wow… Thank you so much, Carlos 🙂 It started to work 🙂

---

<div class="post-metadata">

**Author:** ![anilsr](https://avatars.discourse-cdn.com/v4/letter/a/65b543/32.png) [@anilsr](https://discuss.google.dev/u/anilsr)\
**Post date:** [February 25, 2016, 9:55am UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/4 "2016-02-25T09:55:40Z")

</div>

Thank you [@Carlos Eberhardt](https://community.apigee.com/users/189/carlosapigeecom.html) , I was just looking for same & came across this post.

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [October 13, 2016, 8:07pm UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/5 "2016-10-13T20:07:45Z")

</div>

This is not working for me. I’m experiencing the same issue where I get “\*, \*” in the CORS headers, like below. My policy is like this, using SET..

```auto
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="add-cors">
    <DisplayName>Add CORS</DisplayName>
    <FaultRules/>
    <Properties/>
    <Set>
        <Headers>
            <Header name="Access-Control-Allow-Origin">*</Header>
            <Header name="Access-Control-Allow-Headers">origin, x-requested-with, accept</Header>
            <Header name="Access-Control-Max-Age">3628800</Header>
            <Header name="Access-Control-Allow-Methods">GET, PUT, POST, DELETE</Header>
        </Headers>
    </Set>
    <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
    <AssignTo createNew="false" transport="http" type="response"/>
</AssignMessage>

```

```auto
Access-Control-Allow-Headers: origin, x-requested-with, accept
Access-Control-Allow-Methods: GET, PUT, POST, DELETE
Access-Control-Allow-Origin: *, *
Access-Control-Expose-Headers: X-Mashery-Error-Code, X-Mashery-Responder
Access-Control-Max-Age: 3628800

```

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [October 13, 2016, 8:11pm UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/6 "2016-10-13T20:11:56Z")

</div>

Actually this is odd.. I went as far as to add an assign message policy that REMOVEd all the CORS headers and then SET them, because I thought they might be coming in from the backend service.. It is still broken in Chrome, which reports it as “\*, \*”, but when I curl it I see below

Any Thoughs?

```auto
< HTTP/1.1 200 OK
< Date: Thu, 13 Oct 2016 20:09:52 GMT
< Content-Type: application/json;charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Mashery-Responder: prod-j-worker-atl-04.mashery.com
< X-Powered-By: PHP/5.5.9-1ubuntu4.14
< Cache-Control: max-age=5150
< Vary: Accept-Encoding
< Server: Mashery Proxy
< Access-Control-Allow-Origin: *
< Access-Control-Allow-Headers: origin, x-requested-with, accept
< Access-Control-Max-Age: 3628800
< Access-Control-Allow-Methods: GET, PUT, POST, DELETE

```

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [October 13, 2016, 8:17pm UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/7 "2016-10-13T20:17:06Z")

</div>

Now it gets stranger. Works in Firefox. So what is Chrome doing?

---

<div class="post-metadata">

**Author:** ![ceber](https://avatars.discourse-cdn.com/v4/letter/c/bb73d2/32.png) [@ceber](https://discuss.google.dev/u/ceber)\
**Post date:** [October 13, 2016, 8:38pm UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/8 "2016-10-13T20:38:30Z")

</div>

Weird. Try incognito mode, disable extensions, etc? Maybe something is messing with it.

---

<div class="post-metadata">

**Author:** ![jovaniac](https://d3byx8b92xw3lq.cloudfront.net/user_avatar/discuss.google.dev/jovaniac/32/114464_2.png) [@jovaniac](https://discuss.google.dev/u/jovaniac)\
**Post date:** [April 10, 2019, 6:38am UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/9 "2019-04-10T06:38:06Z")

</div>

```auto
hey guys, I implemented something like that and it served me correctly.

```

```auto
In the proxy enpoint we must place in the preflow the next call of a Flowcallout to invoke a sharedflow which will have the policy of CORS

```

FC-CORS FC-OAuth2

```auto
Definition of flowcallout, where we invoke the sharedflow

```

\<?xml version="1.0" encoding="UTF-8" standalone="yes"?\> FC-CORS OPTIONS-CORS-Headers-Response

```auto
definition of sharedflow

```

\<?xml version="1.0" encoding="UTF-8" standalone="yes"?\> OPTIONS-CORS-Headers-Response request.verb == "OPTIONS"

```auto
definition of the policy of raisefull, where we will indicate the headers of Access-Control-Allow-Origin with * that will allow the invocation from our browser

```

\<?xml version="1.0" encoding="UTF-8" standalone="yes"?\> OPTIONS CORS Headers Response \* origin, x-requested-with, accept, ucsb-api-key, ucsb-api-version, authorization 3628800 GET, PUT, POST, DELETE 200 OK true

angular:

const httpOptions2= { headers:newHttpHeaders({ ‘Authorization’:‘Bearer token’ }) };

obtenerCatalogos():Observable { return this.httpClient.get(uriApigee+‘endpointapigee’,httpOptions2); }

Regars

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [February 27, 2020, 10:43am UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/10 "2020-02-27T10:43:58Z")

</div>

hi [Carlos Eberhardt](https://community.apigee.com/users/8243/ceber.html) / @venkatesh can you please give an example on what you meant by **_Instead of using Add to set the Access-Control-Allow-Origin header, use Set._**

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [February 27, 2020, 11:08am UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/11 "2020-02-27T11:08:20Z")

</div>

figured it out - blend and blindness

---

<div class="post-metadata">

**Author:** ![anonymous8](https://avatars.discourse-cdn.com/v4/letter/a/7cd45c/32.png) [@anonymous8](https://discuss.google.dev/u/anonymous8)\
**Post date:** [November 27, 2020, 3:00pm UTC](https://discuss.google.dev/t/cors-error-header-contains-multiple-values-but-only-one-is-allowed/9334/12 "2020-11-27T15:00:40Z")

</div>

Tks Carlos! Working for me!