title: IIS 10 automatically adds wrong CORS header
body: <p>I have installed IIS CORS moudule on the server.</p>
  
  <p>On the OPTIONS request I get :</p>
  
  <pre><code>Access-Control-Allow-Credentials: true
  Access-Control-Allow-Headers: content-type
  Access-Control-Allow-Methods: GET, HEAD, POST, PUT, DELETE
  Access-Control-Allow-Origin: ### the actual good origin ###
  Date: Fri, 13 Sep 2019 06:32:11 GMT
  Server: Microsoft-IIS/10.0
  Vary: Origin
  X-Powered-By: ASP.NET
  </code></pre>
  
  <p>But on the POST request I get </p>
  
  <pre><code>Access-Control-Allow-Origin: http://localhost/
  Content-Length: 1216
  Content-Type: application/json; charset=utf-8
  Date: Fri, 13 Sep 2019 06:32:11 GMT
  Server: Microsoft-IIS/10.0
  X-Powered-By: ASP.NET
  </code></pre>
  
  <p>In web config i have</p>
  
  <pre><code>  &lt;cors enabled="true"&gt;
    &lt;add origin="### the actual good origin ###" allowCredentials="true" &gt;
  
      &lt;allowHeaders allowAllRequestedHeaders="true" /&gt;
      &lt;allowMethods &gt;
          &lt;add method="GET" /&gt;
          &lt;add method="HEAD" /&gt;
          &lt;add method="POST" /&gt;
          &lt;add method="PUT" /&gt; 
          &lt;add method="DELETE" /&gt;         
      &lt;/allowMethods&gt;
    &lt;/add&gt;
  &lt;/cors&gt;
  </code></pre>
  
  <p>The WebService I try to call is an WCF webservice.</p>
  
  <p>How can I disable the "localhost" header on the POST request?
  I am not setting anything static header, neither in web.config nor in IIS itself</p>