[question] Does handler add AllowedOrigins * header by default?

[harshkolhatkar]

Describe the problem you're having

A clear and concise description of what the bug is.
The HTTPS server uses handler config something like this without specifying AllowedOrigins,

Handler: handlers.CORS(handlers.AllowedHeaders([]string{header1, header2}),
	handlers.AllowedMethods(allowedMethods))(router)

There is a webserver in front of the backend code which adds a Access-Control-Allow-Origin header. Now I get 2 Access-Control-Allow-Origin headers on the UI, one set by the webserver and the other as access-control-allow-origin: *.
Does handlers add * as a default header if not set? I don't see that in the handlers code, but wanted to still verify.
…

Versions

Go version: go version
go1.17.10
package version: run git rev-parse HEAD inside the repo
github.com/gorilla/handlers v1.5.1
…

"Show me the code!"

A minimal code snippet can be useful, otherwise we're left guessing!

Hint: wrap it with backticks to format it

…