How to solve CORS policy on client Pusher?

I have server side written on Laravel and placed on local machine that accepts incoming Pusher messages.

Also there is a client side on the same machine that listens messages:

  var pusher = new Pusher('8976a4eb338b0fe2a5ff', {
      authEndpoint: 'http://127.0.0.1:8000/api/message/auth',
      cluster: 'eu',
      forceTLS: true
    });

When client Pusher tries to auth request and inquires local endpoint:

http://127.0.0.1:8000/api/message/auth.

Chrome returns a typical message:

Access to XMLHttpRequest at 'http://127.0.0.1:8000/api/message/auth' from origin 'null' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Why does it happen if client and server are on the same local address? And how to fix it?

I tried to create middleware in Laravel:

  return $next($request)
            ->header('Access-Control-Allow-Origin', '*')
            ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS')
            ->header('Access-Control-Allow-Headers', '*');

but without success

via Chebli Mohamed