Missing Access-Control-Allow-Origin header with CORS when Origin is not allowed.

[JCHacking]

Example Code

from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware # It's CORSMiddleware from starlette

app = FastAPI()

app.add_middleware(
    CORSMiddleware,
    allow_origins=["http://test.com"],
    allow_methods=["GET"],
)

Description

Steps to reproduce

• Make request OPTIONS http://localhost:8000 with headers Origin="http://example.com" and Access-Control-Request-Method="GET"
• See response headers don't have Access-Control-Allow-Origin

Question

Is this expected, or is it a strange behavior?