From 17e330e7f3a7730a4d89ba05de123bd654671878 Mon Sep 17 00:00:00 2001
From: Jym Dyer <jym.dyer@ibigroup.com>
Date: Mon, 30 Oct 2023 14:08:35 -0700
Subject: [PATCH 1/3] For proxied responses, we have been combining headers
 which can create duplicates ("Access-Control-Allow-Origin" is the most
 problematic). So dedupe them.

---
 .../controllers/api/OtpRequestProcessor.java           | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/opentripplanner/middleware/controllers/api/OtpRequestProcessor.java b/src/main/java/org/opentripplanner/middleware/controllers/api/OtpRequestProcessor.java
index 084ac7d57..44b9c2864 100644
--- a/src/main/java/org/opentripplanner/middleware/controllers/api/OtpRequestProcessor.java
+++ b/src/main/java/org/opentripplanner/middleware/controllers/api/OtpRequestProcessor.java
@@ -210,11 +210,15 @@ private String proxyPost(Request request, Response response) {
             } catch(NullPointerException e) {
                 LOG.warn("Failed to read variables from GraphQL Plan request. Still passing to OTP2: {}", e.getMessage());
             }
-
         }
 
-        // provide response to requester as received from OTP server
-        Arrays.stream(otpDispatcherResponse.headers).forEach(header -> response.header(header.getName(), header.getValue()));
+        // Add response headers to requester as it was received from OTP server, but beware that
+        // spark.Response#header() will duplicate rather than update, so filter out duplicates.
+        Arrays.stream(otpDispatcherResponse.headers)
+            .filter(h -> !response.raw().containsHeader(h.getName()))
+            //.peek(h -> LOG.info("NEW {}={}", h.getName(), h.getValue()))
+            .forEach(h -> response.header(h.getName(), h.getValue()));
+
         response.status(otpDispatcherResponse.statusCode);
         return otpDispatcherResponse.responseBody;
     }

From 38f19d2f58f9593943d02ce1ecd95848df6e07c3 Mon Sep 17 00:00:00 2001
From: Jym Dyer <jym.dyer@ibigroup.com>
Date: Tue, 31 Oct 2023 08:35:38 -0700
Subject: [PATCH 2/3] Update spark-core version.

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index ad2736f90..37d79304c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -204,7 +204,7 @@
         <dependency>
             <groupId>com.sparkjava</groupId>
             <artifactId>spark-core</artifactId>
-            <version>2.7.2</version>
+            <version>2.9.4</version>
         </dependency>
 
         <!--

From 9e5ecdde1a1f8814ac1d6a550168ec6753ee9407 Mon Sep 17 00:00:00 2001
From: Jym Dyer <jym.dyer@ibigroup.com>
Date: Tue, 31 Oct 2023 08:40:34 -0700
Subject: [PATCH 3/3] Remove (commented-out) .peek() logging.

---
 .../middleware/controllers/api/OtpRequestProcessor.java          | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/main/java/org/opentripplanner/middleware/controllers/api/OtpRequestProcessor.java b/src/main/java/org/opentripplanner/middleware/controllers/api/OtpRequestProcessor.java
index 44b9c2864..362bdcb7e 100644
--- a/src/main/java/org/opentripplanner/middleware/controllers/api/OtpRequestProcessor.java
+++ b/src/main/java/org/opentripplanner/middleware/controllers/api/OtpRequestProcessor.java
@@ -216,7 +216,6 @@ private String proxyPost(Request request, Response response) {
         // spark.Response#header() will duplicate rather than update, so filter out duplicates.
         Arrays.stream(otpDispatcherResponse.headers)
             .filter(h -> !response.raw().containsHeader(h.getName()))
-            //.peek(h -> LOG.info("NEW {}={}", h.getName(), h.getValue()))
             .forEach(h -> response.header(h.getName(), h.getValue()));
 
         response.status(otpDispatcherResponse.statusCode);