Does strapi cors accept localhost requests no matter what?

Questions and Answers
1
System Information
  • Strapi Version: v4
  • Operating System: wsl linux
  • Database: postgres
  • Node Version: 16
  • NPM Version: 7.10.0
  • Yarn Version: 1.22.19

I have configured my cors as follows:

Explanation at the bottom

./config/middleware.js

module.exports = [
  "strapi::errors",
  "strapi::security",
  {
    name: "strapi::cors",
    config: {
      origin: [
        "https://wrestlingtournaments.com",
        "http://wrestlingtournaments.com",
        "https://wrestle.wrestlingtournaments.com",
        "http://wrestle.wrestlingtournaments.com",
      ],
      methods: ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"],
      headers: ["Content-Type", "Authorization", "Origin", "Accept"],
      keepHeaderOnError: true,
    },
  },
  "strapi::poweredBy",
  "strapi::logger",
  "strapi::query",
  "strapi::body",
  "strapi::session",
  "strapi::favicon",
  "strapi::public",
];

Issue:

Despite limiting my origins as per the Strapi docs here link and running the build and start commands which should give production behavior. I am getting 200 success messages on my strapi server and it is serving me the data to my frontend. Is there an error in my config or is Strapi not giving me production behaivore?