When i fetch in my website i have always result and origin allowed is always all (*) despite i allowed only http://localhost:8 origin

const response = await fetch("http://localhost:8000/api/demo");
const p = await response.json();
console.log(p);

When i fetch in my website i have always result and origin allowed is always all (*) despite i allowed only http://localhost:8 origin

const response = await fetch("http://localhost:8000/api/demo");
const p = await response.json();
console.log(p);

Codes of App/Http/middleware/cors.php ::::

<?php

namespace AppHttpMiddleware;

use Closure;
use IlluminateHttpRequest;
use SymfonyComponentHttpFoundationResponse;

class cors
{
/**
 * Handle an incoming request.
 *
 * @param  Closure(IlluminateHttpRequest): (SymfonyComponentHttpFoundationResponse)  $next
 */
public function handle(Request $request, Closure $next): Response
{
    $response = $next($request);
    $response->headers->set('Access-Control-Allow-Origin', 'http://localhost:8');
    $response->headers->set('Access-Control-Allow-Methods', 'POST, GET, OPTIONS, PUT, DELETE');
    $response->headers->set('Access-Control-Allow-Headers', 'Content-Type, X-Auth-Token,
    Origin,Authorization');

    return $response;

    
}
}

codes bootstrap/app.php

<?php

use IlluminateFoundationApplication;
 use IlluminateFoundationConfigurationExceptions;
use IlluminateFoundationConfigurationMiddleware;

return Application::configure(basePath: dirname(__DIR__))
->withRouting(
    web: __DIR__.'/../routes/web.php',
    api: __DIR__.'/../routes/api.php',
    commands: __DIR__.'/../routes/console.php',
    health: '/up',
)
->withMiddleware(function (Middleware $middleware) {
    // 
   $middleware->append(AppHttpMiddlewareCors::class);
})
->withExceptions(function (Exceptions $exceptions) {
    //
})->create();