Access-Allow-Control-Origin does not restrict access from other domains

Question

I am creating an Api with Nodejs, where I set the application header to work properly Cross-Origin Resource Sharing.

app.use(function (req, res, next) {
    res.header("Access-Control-Allow-Origin", "http://localhost:3000");
    res.header("Access-Control-Allow-Headers", "Content-Type");
    res.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE");
    res.header('Access-Control-Allow-Credentials', true);
    next();
});

Where in the code I restrict access only so localhost:3000 can access the resources. res.header("Access-Control-Allow-Origin", "http://localhost:3000");

Only even though it leaves access restricted to only one application, I can access the resources of this Api from any domain. What’s the matter with Access-Control-Allow-Origin that doesn’t work?