The ‘Access-Control-Allow-Origin’ header contains multiple values ’*, *’, but only one is allowed

The Access-Control-Allow-Origin header is used in an HTTP response to indicate which origins are allowed to make cross-origin requests to a resource. When the Access-Control-Allow-Origin header contains multiple values, it is invalid and the server will return an error.

The most common cause of this error is that the server is including the Access-Control-Allow-Origin header multiple times in the response. To fix this, the server should ensure that the Access-Control-Allow-Origin header is included only once in the response, with a single origin value.

For example, if the server wants to allow all origins to access the resource, it should include the Access-Control-Allow-Origin header with the value *:

Access-Control-Allow-Origin: *

If the server wants to allow only specific origins to access the resource, it should include the Access-Control-Allow-Origin header with a comma-separated list of those origins:

Access-Control-Allow-Origin: https://example.com, https://example.org

It is also possible that the error is being caused by a client-side script that is attempting to set the Access-Control-Allow-Origin header in the response. This is not allowed, as the Access-Control-Allow-Origin header must be set by the server, not the client.