Access-control-orgin header not resetting

See more:

C#

IIS

C#4.0

security

cypher

IIS10

Hi Team,

can someone help me to solve the security headers Access-Control-Allow-Origin in IIS.

I have one webserver and 1 app server. In the webserver using to redirect the public hit to app server with help of URLRewrite module. We are using burp suite tool to perform security testing. In the request we have headers like access-control-allow-orgin, orgin and so many. When i modify the header orgin and send the request then by default response header also changing as per the request. Eventhough i am adding the header through C# code and IIS headers but still header is modifying.

ANy idea why this header not reset with defined header values?

What I have tried:

- Removed the headers from api gateway and respective micros services and keep only in webserver headers. But still header changing based on orgin request
- Completely removed the header from all services and web server site.