The ‘Access-Control-Allow-Origin’ header contains multiple values ‘*, *’, but only one is allowed

You are setting CORS twice. I think that is the issue.

Please remove any one CORS settings. You can either remove it from web.config or from WebApiConfigFile.cs.