For proxied responses, we have been combining headers which we need to dedupe

[JymDyerIBI]

Of the duplicates, "Access-Control-Allow-Origin" is the most problematic because browsers stop on that as an error.

Checklist

• Appropriate branch selected (all PRs must first be merged to dev before they can be merged to master)
• Any modified or new methods or classes have helpful JavaDoc and code is thoroughly commented
• The description lists all applicable issues this PR seeks to resolve
• The description lists any configuration setting(s) that differ from the default settings
• All tests and CI builds passing

Description

When we proxy a POST request through the middleware we have request headers from the middleware's Spark Framework and we update them with the request headers from the GraphQL endpoint being proxied to. Unfortunately the com.sparkjava.spark.Response#header() method doesn't let you update a header, it creates duplicate headers. So I added a filter to prevent that.

Apparently the RFC for response headers is unclear (and thus undefined) on the legality of duplicate headers, but browsers specifically fail on duplicate Access-Control-Allow-Origin headers.

[binh-dam-ibigroup]

Good finding!

[leonardehrenfried]

This code looks fine but I can also make the CORS headers optional in OTP itself (but will increase the risk of a misconfiguration breaking a deployment.)