title: Laravel angularJS CORS using barryvdh/laravel-cors not working on IIS
body: <p>I have problem with cross domain request to an API hosted on IIS.</p>
  
  <p>I am using an angularjs application to fetch data from the API, which is developed with laravel 5 using tymondesigns/jwt-auth and barryvdh/laravel-cors package for JWT and CORS.</p>
  
  <p>When the API is hosted on apache angularjs app fetches data.But when hosted on IIS it gives following error:</p>
  
  <pre><code>XMLHttpRequest cannot load http://example.com/api/authenticate. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost' is therefore not allowed access.
  </code></pre>
  
  <p>The preflight request response header:</p>
  
  <pre><code>Request URL:http://example.com/api/authenticate
  Request Method:OPTIONS
  Status Code:200 OK
  Allow:OPTIONS, TRACE, GET, HEAD, POST
  Content-Length:0
  Public:OPTIONS, TRACE, GET, HEAD, POST
  Server:Microsoft-IIS/8.5
  X-Powered-By:ASP.NET
  </code></pre>
  
  <p>My first question is why "Access-Control-Allow-Origin" is not set, when hosted on IIS. Is there any special setting to enable CORS on IIS.</p>
  
  <p>So then I added following lines to web.config file:</p>
  
  <pre><code>&lt;httpProtocol&gt;
      &lt;customHeaders&gt;
          &lt;remove name="Access-Control-Allow-Origin" /&gt;   
          &lt;add name="Access-Control-Allow-Origin" value="*" /&gt;
          &lt;remove name="Access-Control-Allow-Headers" /&gt;
         &lt;add name="Access-Control-Allow-Headers" value="Origin, Content-Type, Authorization, Accept, X-Request-With" /&gt;
     &lt;/customHeaders&gt;
  &lt;/httpProtocol&gt;
  </code></pre>
  
  <p>Now it give following error:</p>
  
  <pre><code>XMLHttpRequest cannot load http://example.com/api/authenticate. The 'Access-Control-Allow-Origin' header contains multiple values 'http://localhost, *', but only one is allowed. Origin 'http://localhost' is therefore not allowed access.
  </code></pre>
  
  <p>The preflight request response header:</p>
  
  <pre><code>Request Method:OPTIONS
  Status Code:200 OK
  Access-Control-Allow-Headers:Origin, Content-Type, Authorization, Accept, X-Request-With
  Access-Control-Allow-Origin:*
  Allow:OPTIONS, TRACE, GET, HEAD, POST
  Public:OPTIONS, TRACE, GET, HEAD, POST
  Server:Microsoft-IIS/8.5
  X-Powered-By:ASP.NET
  </code></pre>
  
  <p>The actual request response header:</p>
  
  <pre><code>Request Method:POST
  Status Code:200 OK
  Access-Control-Allow-Headers:Origin, Content-Type, Authorization, Accept, X-Request-With
  Access-Control-Allow-Origin:http://localhost
  Access-Control-Allow-Origin:*
  Content-Type:application/json
  Server:Microsoft-IIS/8.5
  Set-Cookie:XSRF-TOKEN=eyJpdiI6IkpwNnU2mTnc9PSIsInam9jTFpxb0ptak1IMmFsQ3ZZhbMTM5ZTMzMjgyZWIyNCJ9; expires=Thu, 27-Aug-2015 12:52:55 GMT; Max-Age=7200; path=/; httponly
  Vary:Origin
  X-Powered-By:ASP.NET
  X-Powered-By:PHP/5.6.0
  </code></pre>
  
  <p>So Why "Access-Control-Allow-Origin" is repeating" on actual request response header.</p>
  
  <p>Is it secure to add "Access-Control-Allow-Origin" to web.config file.</p>