Response returned even if Origin not allowed

[es-lab]

I'm limiting my web service to only some origins. If I try to make a request from an origin not allowed I get the error Origin 'xxxx' is therefore not allowed access. in the console, but I still get the response, is this normal? How to block the access to the further resources.

[rs]

This is expected. CORS is not supposed to prevent the response from being returned.