Cors on Tomcat returns multiple Allow-Origin headers

[Stitch10925]

I have a docker container running PlantUML server Tomcat version on the following address: http://192.168.1.10/ I have a website that makes a post request to the server. With some content in the body:

URL: http://192.168.1.10/png BODY: Bob -> Alice : hello2 Steve -> Jonah Sven -> Miriam Hans -> Grietje

This should return an image, which works fine in Postman. However, when performing this post request in the browser using Javascript, the browser blocks the response with a Cors error: Multiple Cors headers are not allowed.

When looking at the response it indeed has 2 Cors headers:

• Access-Control-Allow-Origin: *
• Access-Control-Allow-Origin: http://192.168.1.10/

The first one is the one added by PlantUML server (persumably DiagramResponse.java lines 205 or 122), the second one is added by Tomcat.

When I disable the CorsFilter in Tomcat no Access-Control-Allow-Origin are returned, not even the one from PlantUML. This means I cannot make any POST calls to my local server because I either get no Access-Control-Allow-Origin headers or I get two, both cause the browser to give a Cors error.

Is there a way to stop PlantUML from adding the Access-Control-Allow-Origin header by default? Maybe using a parameter? Or is there a way to configure Tomcat to return only one header?

Tomcat CorsFilter configuration:

CorsFilter org.apache.catalina.filters.CorsFilter cors.allowed.origins http://192.168.1.10/ cors.allowed.methods GET,POST cors.allowed.headers Content-Type,Authorization,Accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,Content-Length,Connection cors.exposed.headers Access-Control-Allow-Origin,Access-Control-Allow-Credentials cors.support.credentials false