Cors headers are duplicated on server but local doesn't

I use

Spring framework 4.2.5
Apache Tomcat 8.5
Cent OS 7

When I run my project in local pc

Cors headers are looks like

Access-Control-Allow-Headers: x-requested-with, origin, content-type, accept, Authorization
Access-Control-Allow-Methods: GET, POST, PUT, HEAD, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600

but when i run the project on server

Access-Control-Allow-Headers: x-requested-with, origin, content-type, accept, Authorization
Access-Control-Allow-Headers: authorization, content-type, xsrf-token
Access-Control-Allow-Methods: GET, POST, PUT, HEAD, OPTIONS
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin: *
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: xsrf-token
Access-Control-Max-Age: 3600
Access-Control-Max-Age: 3600

headers are duplicated

I'm so hesitated.

I've checked CATALINA_HOME's web.xml also BASE's web.xml

but there was no cors options