cors issue: blocking works wrongly

**Node version**: v14.17.6
**Sails version** _(sails)_: 1.5.3
**ORM hook version** _(sails-hook-orm)_: 3.0.2
**Sockets hook version** _(sails-hook-sockets)_: N/A
**Organics hook version** _(sails-hook-organics)_: N/A
**Grunt hook version** _(sails-hook-grunt)_: 5.0.0
**Uploads hook version** _(sails-hook-uploads)_: N/A
**DB adapter & version** _(e.g. sails-mysql@5.55.5)_: sails-postgresql 2.0.0
**Skipper adapter & version** _(e.g. skipper-s3@5.55.5)_: 0.9.1

In order to make a sails API available to be called from specific external hosts, cors issue was raised.
After apply configs as described in documentation:
```
module.exports.security = {
csrf: true,
cors: {
allRoutes: true,
allowOrigins:
[
"https://url1",
"http://url2",
"https://url3"
],
allowCredentials: true,
allowRequestHeaders: "Origin, Content-Type, x-xsrf-token",
}
};
```
It was noticed a strange behaviour..
locally it works as expected, but when deployed to server with kubernetes the behaviour is the opposite!
for requests that should be allowed CORS error is raised, for requests that should be NOT allowed successful answers are returned.

ps: trying to use also CSRF token to help in CORS issue but with no success

it seems the header Access-Control-Allow-Origin is overriden, then in the request there are 2 Access-Control-Allow-Origin

--> following the debug it seems the requests are blocked in route middleware.. but we can't debug what happens there and why this overwrite happens..

Can you help here?

No source file or test is named. Start by reproducing the reported CORS configuration locally and in the Kubernetes deployment, then inspect the route middleware and response headers where the issue appears to be blocked or overwritten. Done means allowed origins receive the expected CORS headers and disallowed origins do not.

Written by the indexing model from the issue text.