Merge branch 'nusphere-develop' into develop

src/JK/RestServer/HeaderManager.php

@@ -13,6 +13,11 @@ final class HeaderManager
     /** @var array Colletion of HTTP headers */
     private $headers = array();
 
+    /** These headers are only once allowed */
+    private $singleHeader = [
+        "Access-Control-Allow-Origin"
+    ];
+
     /**
      * Sets some defaults
      */
@@ -121,7 +126,23 @@ public function sendAllHeaders()
         }
 
         foreach ($this->headers as $name => $value) {
-            header($name . ': ' . $value);
+            if (!$this->isSingleHeaderAndNotAlreadySent($name)) {
+                header($name . ': ' . $value);
+            }
         }
     }
+
+    /**
+     * Bugfix: Remove duplicates of headers which are required to be single
+     *
+     * https://stackoverflow.com/questions/15682496/will-duplicate-access-control-allow-origin-headers-break-cors
+     */
+    private function isSingleHeaderAndNotAlreadySent(string $name): bool
+    {
+        if (!in_array($name, $this->singleHeader)) {
+            return false;
+        }
+
+        return array_key_exists($name, array_keys(headers_list()));
+    }
 }