CORS headers not sent for some redirects

[ghost]

Checklist

• This is a bug report, not a question. Ask questions on discuss.ipfs.io.
• I have searched on the issue tracker for my bug.
• I am running the latest go-ipfs version or have an issue updating.

Installation method

ipfs-update or dist.ipfs.io

Version

go-ipfs version: 0.10.0
Repo version: 11
System version: amd64/linux
Golang version: go1.16.8

Config

No response

Description

cors headers are properly sent for redirects to ipfs.localhost:8080:

$ curl -I localhost:8080/ipfs/QmVCYUK51Miz4jEjJxCq3bA6dfq5FXD6s2EYp6LjHQhGmh/meta
HTTP/1.1 301 Moved Permanently
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Headers: Range
Access-Control-Allow-Headers: User-Agent
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Range
Access-Control-Expose-Headers: X-Chunked-Output
Access-Control-Expose-Headers: X-Stream-Output
Cache-Control: public, max-age=29030400, immutable
Content-Length: 26
Content-Type: application/octet-stream
Etag: "QmbaoVNrRZjpxjEYe96qMbPQGk6yHG3az5izWbxurQ7L1F"
Last-Modified: Thu, 01 Jan 1970 00:00:01 GMT
Location: http://bafybeidf5yn56cxk6zkyjmay4wigu2o7ynqh7q62z3kppag5v7jpqavy5q.ipfs.localhost:8080/meta
X-Ipfs-Path: /ipfs/QmVCYUK51Miz4jEjJxCq3bA6dfq5FXD6s2EYp6LjHQhGmh/meta
Date: Sat, 09 Oct 2021 00:11:06 GMT

and cors headers are properly sent according to the configuration for properly-formatted paths:

$ curl -I -H 'host: bafybeidf5yn56cxk6zkyjmay4wigu2o7ynqh7q62z3kppag5v7jpqavy5q.ipfs.localhost:8080' localhost:8080/meta
HTTP/1.1 200 OK
Accept-Ranges: bytes
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Headers: Range
Access-Control-Allow-Headers: User-Agent
Access-Control-Allow-Headers: X-Requested-With
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Range
Access-Control-Expose-Headers: X-Chunked-Output
Access-Control-Expose-Headers: X-Stream-Output
Cache-Control: public, max-age=29030400, immutable
Content-Length: 26
Content-Type: application/octet-stream
Etag: "QmbaoVNrRZjpxjEYe96qMbPQGk6yHG3az5izWbxurQ7L1F"
Last-Modified: Thu, 01 Jan 1970 00:00:01 GMT
X-Ipfs-Path: /ipfs/bafybeidf5yn56cxk6zkyjmay4wigu2o7ynqh7q62z3kppag5v7jpqavy5q/meta
Date: Sat, 09 Oct 2021 00:06:00 GMT

but if there is an extra / in the path, the headers are NOT sent:

$ curl -I localhost:8080/ipfs/QmVCYUK51Miz4jEjJxCq3bA6dfq5FXD6s2EYp6LjHQhGmh//meta
HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=utf-8
Location: /ipfs/QmVCYUK51Miz4jEjJxCq3bA6dfq5FXD6s2EYp6LjHQhGmh/meta
Date: Sat, 09 Oct 2021 00:13:09 GMT

This took hours for me to figure out why I couldn't fetch() from a localhost domain to the daemon running on localhost:8080 despite my configuration with CORS enabled.