Access-Control-Expose-Headers response header duplicate values

[craigbeck]

• Hapi v11.1.1
• making CORS request failing in Chrom, Safari, succeeds in Firefox
• notice duplicate values in Access-Control-Expose-Headers response header

access-control-expose-headers: WWW-Authenticate,Server-Authorization,WWW-Authenticate,Server-Authorization

Header gets set in cors.js line 140 and get appended to in cors.js line 168

[craigbeck]

I have a failing test.

It looks like with option of cors: true line 140 doesn't get hit, so line 168 sets the correct values. When using non-default CORS configuratoin, line 140 and line 160 get executed and the header values get duplicated.

[craigbeck]

I'm unclear as to a fix or what exactly are the conditions for both lines 140 and 168 to get executed. The first couple of tests in #2953 fail but don't double-append (nothing is appended). I added an assertion to 'matches allowed headers (Origin explicit)' test that executes both lines that shows the issue.

[hueniverse]

The three new tests you added are not necessary. The two that fail are because your config and origin do not match (missing tailing / in the config). The last change is the actual problem and I'll fix it shortly.