CORS errors for GraphQL requests

[andyra]

I'm using NextJS as a front-end for Statamic, but I'm running into CORS errors when requesting data from Statamic via GraphQL:

client-side:1 Access to fetch at 'https://office.tes.fm/graphql' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

The config/cors.php file in my Statmic project looks like it's in good shape for allowing access, though:

return [
    'paths' => ['api/*', 'graphql/*'],
    'allowed_methods' => ['*'],
    'allowed_origins' => ['*', 'http://localhost:3000'],
    'allowed_origins_patterns' => [],
    'allowed_headers' => ['*'],
    'exposed_headers' => [],
    'max_age' => 0,
    'supports_credentials' => false,
];

When I open Chrome's developer tools and check the Network tab for response headers for https://office.tes.fm/graphql, I would expect to see access-control-allow-origin: *, but this is what the response looks like:

Cache-Control: no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Sat, 20 Nov 2021 22:33:11 GMT
Location: https://office.tes.fm/graphiql
Permissions-Policy: interest-cohort=()
Server: nginx/1.18.0 (Ubuntu)
Set-Cookie: XSRF-TOKEN=eyJpdiI6ImtPWkwrNlVhRHVQVmt5TnJTSmNIL3c9PSIsInZhbHVlIjoiWHZsS09jOENUQStNZG80S2lDS3QwbnVENDBkSUtyZ0hnUXZHMUdxUU5yMklrSG5XZDI3QmdrOGcrajBiSG41dzE3bkM2QTRkZU9HNFJIK3RHZndMNk1ldEhBQ2dBSFZSUzVrbklrVEswMTlpUldhbGdic0pRZkVlZjM5MzBGZWEiLCJtYWMiOiJlMWIzYWEyNGFmMDMyNjVjMzI0YmExMzU1MmUzYjNkNGZlYzUzNWFlZDg0YjE3ZGNjNDliMWVmMDU3ZjAxY2E1IiwidGFnIjoiIn0%3D; expires=Sun, 21-Nov-2021 00:33:11 GMT; Max-Age=7200; path=/; samesite=lax
Set-Cookie: tes_session=eyJpdiI6InR2Q1ZuK0trTDFMOXZkcjdPZW0vZ0E9PSIsInZhbHVlIjoiQmdHQzRVRDVQclFUeXdWRnJkTHd4emExZFZjSzFBUVZ0dTgwNlJPZEFab1ZPV2trcHlHZUo2cEh5S1Zvc2NpdVA2U25RNHBYeHdoR09jUi9nRGFYaUtJcFFXVWZQdEplNnBGRUYvYkFoYkdnblJvc0lZSGREVHZXbnE1WGk2eFQiLCJtYWMiOiI2MWE0YTkwMjYzZmNmNTA4ZWFlOTczMmQ5ZDI0Yzc5ZTM2MmVhYTM5OTY2OWViNDU0YWE2ZGEyZTM4MGY1N2QyIiwidGFnIjoiIn0%3D; expires=Sun, 21-Nov-2021 00:33:11 GMT; Max-Age=7200; path=/; httponly; samesite=lax
Transfer-Encoding: chunked
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block

Is there some other way I need to set access-control-allow-origin in Statamic/Laravel to allow GraphQL requests from my front-end?