A detailed answer with solution for the JDK HttpClient can be found at Setting "Origin" and "Access-Control-Request-Method" headers with Jersey Client:

Some restricted headers are blocked and not transmitted by the JDK HttpClient-API (including "Origin"). You can override it by using

System.setProperty("sun.net.http.allowRestrictedHeaders", "true");