CORS Cross Origin
Multiple Allow-Origin
Reviewed for reference consistency: August 11, 2026
The 'Access-Control-Allow-Origin' header contains multiple values, but only one is allowed.
What Multiple Allow-Origin Means
The Multiple Allow-Origin error on the CORS Cross Origin indicates multiple allow-origin — the 'access-control-allow-origin' header contains multiple values, but only one is allowed.. This typically occurs due to cors headers are being inadvertently set at multiple layers of the server infrastructure (e.g., once in the node.js app code, and again in the nginx reverse proxy)..
The CORS specification strictly dictates that the 'Access-Control-Allow-Origin' header can only contain a SINGLE origin URL (e.g., 'https://example.com') or the wildcard '*'. It absolutely cannot contain a comma-separated list of multiple origins. If the browser sees multiple origins in the header value, or detects multiple instances of the header itself in the HTTP response, it instantly flags a syntax error and rejects the request.
How to fix Multiple Allow-Origin
General informational guidance, not professional advice. Commands can affect your system or data — back up first and proceed at your own risk. FixerCode is an independent reference, not affiliated with any vendor mentioned.
Inspect raw HTTP headers
Use a command-line tool to inspect the raw HTTP response headers. Look for duplicate lines of 'Access-Control-Allow-Origin'.
curl -I -v http://api.example.comRemove duplicate proxy headers
If you find duplicate headers, identify which infrastructure layers are adding them. Usually, it's best to handle CORS exclusively in the application code OR exclusively in the proxy, but not both.
Implement dynamic origin reflection
If you need to support multiple origins, do not use a comma-separated list. Your backend must check the incoming 'Origin' header against an array, and return only the single matching origin.
Technical Background
The CORS specification is exceptionally strict about header formatting to avoid parsing ambiguities. The 'Access-Control-Allow-Origin' header is designed to contain exactly one single origin, or the wildcard '*'.
If an HTTP response contains two 'Access-Control-Allow-Origin' headers, or one header with a comma-separated list of origins (e.g., 'https://a.com, https://b.com'), the browser considers it a fatal syntax error.
This strictness prevents scenarios where a poorly written browser parser might misinterpret a complicated list of origins, potentially opening up a security vulnerability.
Invalid syntax results in a total failure of the CORS security check, completely blocking the frontend code from reading the response data.
Common Causes
- CORS headers are being inadvertently set at multiple layers of the server infrastructure (e.g., once in the Node.js app code, and again in the Nginx reverse proxy).
- The backend application code is accidentally concatenating multiple whitelist origins into a single header string (e.g., 'http://site-a.com, http://site-b.com').
- A cloud provider or CDN (like Cloudflare, AWS CloudFront, or Vercel) is injecting a default CORS header on top of the origin server's existing CORS header.
Typical Scenarios
- A developer adds CORS middleware in their Express backend, but their DevOps team also configured Nginx with an 'add_header' directive for CORS, resulting in duplicate headers.
- Attempting to whitelist two partner domains by returning 'Access-Control-Allow-Origin: domain1.com, domain2.com' instead of dynamically checking the origin.
- Deploying an app to a platform-as-a-service (PaaS) that automatically handles CORS, conflicting with the app's internal CORS logic.
What to Know
Use the Network tab in your browser's Developer Tools, or a command-line tool like cURL, to inspect the raw HTTP response headers. Identify which layers of your stack (application code, reverse proxy, CDN) are injecting the header and remove the duplicates so only one valid header remains.
Frequently Asked Questions
Common questions about CORS Multiple Allow-Origin error
Usually this happens when you enable CORS in your application code (like Node.js or Python), but your reverse proxy (like Nginx, Apache, or a cloud CDN) is also configured to automatically inject CORS headers. The HTTP response ends up with two identical headers, which browsers reject.
No. The HTTP specification for CORS does not support arrays or comma-separated lists in the Access-Control-Allow-Origin header. It must be exactly one single URL (or the wildcard '*').
You must write backend logic (or use standard CORS middleware) that reads the incoming 'Origin' header from the request. If the incoming origin matches one of your three allowed websites, your server should respond with that specific origin. It's a dynamic 1-to-1 reflection.
Related Error Codes
Related Errors From Other Categories
Similar error codes documented across different platforms and systems
Shell Misuse — improper use of shell built-ins or syntax
Command Not Found — the specified command or file could not be located
Terminated by User — the process was interrupted by a SIGINT signal
Invalid Exit Argument — script exited with an out-of-range status or terminated by a signal