Access-Control-Allow-Origin is returned only if correct Origin header is available

[neer3]

I am trying to set a custom origin (regex pattern) /\Ahttps:\/\/[^,]+\.example\.com\z/

Here is the cors.rb

Rails.application.config.middleware.insert_before 0, Rack::Cors, :debug => true, :logger => (-> { Rails.logger })  do
  allow do
    origins /\Ahttps:\/\/[^,]+\.example\.com\z/

    resource '*',
      headers: :any,
      methods: %i[get post put patch delete options head]
  end
end

But the issue is whenever I pass the incorrect origin to the server, it does not respond back with any Access-Control-Allow-Origin response header. (By incorrect origin I mean passing something like https://test.com, https://abc.com)

Whenever the origin is correct it is working fine.

Rails 7.0.3.1 Ruby 3.1.2p20