localhost is therefore not allowed access

Question

To solve CORS issue, I wrote there

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST');
header("Access-Control-Allow-Headers: X-Requested-With"); 

in my server site

but during my development I'm seeing this error

The 'Access-Control-Allow-Origin' header contains multiple values '*, *', but only one is allowed. Origin 'http://localhost' is therefore not allowed access.

I thought allow-origin: * will solve everything? But why it says header contain multiple values?

Answer 1

This is a common problem when accidently enabling CORS twice. Check to make sure you did not enable it in apache, or that the header is not being set twice. As a sanity check you can try to remove the header and add it right back before you serve out your response.

Ex:

header_remove('Access-Control-Allow-Origin');
header('Access-Control-Allow-Origin: *');