title: httpd duplicate Access-Control-Allow-Origin with "Header always set"
body: <p>I am trying to enable CORS on my server. It hosts both an Apache HTTPD and an Apache Tomee.
  HTTPD is configured as:</p>
  
  <pre><code>SetEnvIf Origin "^https://(.+\.)?my-domain.com$" allowed_origin=$0
  Header always set Access-Control-Allow-Origin %{allowed_origin}e env=allowed_origin
  Header set Access-Control-Allow-Credentials "true"
  Header set Access-Control-Allow-Methods "GET, POST, OPTIONS, HEAD, PUT, DELETE, PATCH"
  Header set Access-Control-Allow-Headers "accept,x-requested-method,origin,x-requested-with,x-request,cache-control,content-type"
  Header set Access-Control-Max-Age "600"
  </code></pre>
  
  <p>and my Tomee web XML :</p>
  
  <pre><code>&lt;filter&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;filter-class&gt;org.apache.catalina.filters.CorsFilter&lt;/filter-class&gt;
    &lt;init-param&gt;
      &lt;param-name&gt;cors.allowed.headers&lt;/param-name&gt;
      &lt;param-value&gt;Origin,Accept,X-Requested-With,Content-Type,Access-Control-Request-Method,Access-Control-Request-Headers,Accept-Language,Keep-Alive&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;init-param&gt;
      &lt;param-name&gt;cors.allowed.methods&lt;/param-name&gt;
      &lt;param-value&gt;GET,POST,HEAD,OPTIONS,PUT,PATCH,DELETE&lt;/param-value&gt;
    &lt;/init-param&gt;
  &lt;/filter&gt;
  &lt;filter-mapping&gt;
    &lt;filter-name&gt;CorsFilter&lt;/filter-name&gt;
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>My problem is I get the <code>Access-Control-Allow-Credentials</code> header twice in the response to the preflight OPTIONS request :</p>
  
  <pre><code>HTTP/1.1 200 OK
  Access-Control-Allow-Origin: https://my-origin.my-domain.com
  Access-Control-Allow-Origin: https://my-origin.my-domain.com
  Access-Control-Allow-Credentials: true
  Access-Control-Max-Age: 600
  Access-Control-Allow-Methods: GET, POST, OPTIONS, HEAD, PUT, DELETE, PATCH
  Access-Control-Allow-Headers: accept,x-requested-method,origin,x-requested-with,x-request,cache-control,content-type,authorization
  </code></pre>
  
  <p>I don't understand why the usage of the <code>set</code> keyword in my HTTPD configuration does not remove the duplicate <code>Access-Control-Allow-Origin</code>.
  Moreover, if I remove the 'always' keyword it returns one <code>Access-Control-Allow-Origin</code> only...</p>