Custom forge app error cors external api

[Alessandro Volpato]

Hi, I am creating an issue panel and i need to make a call to an external mongodb endpoint. I have configured a function in the following way

async function sendDataToDB() {

const response = await fetch('https://westeurope.azure.data.mongodb-api.com/app/data-tgmerrf/endpoint/data/v1/action/insertOne', {

method: 'POST',

headers: {

'Content-Type': 'application/json',

'api-key': 'KEY',

'Access-Control-Allow-Origin': '*'

 },

body: JSON.stringify({

"collection": "collection",

"database": "db",

"dataSource": "datasource",

"document": {

"name": "John Sample",

"age": 42

 }

 })

 });

const data = await response.json();

return data;

 }

the problem is that it gives me cors error

Access to the fetch of 'https://westeurope.azure.data.mongodb-api.com/app/data-tgmerrf/endpoint/data/v1/action/insertOne' from the source 'http://localhost:8000' was blocked by the CORS policy: Response to preflight request fails access control: 'Access-Control-Allow-Origin' header is not present on the requested resource. If you need an opaque response, set the request mode to 'no-cors' to retrieve the resource with CORS disabled. I

also tried putting mode: 'no-cors' but headers api-key is not used and therefore does not do authentication How can I solve the problem? Translated with DeepL.com (free version)

[marc -Collabello--Phase Locked-]

This is not a solution to your problem, but you are exposing the mongodb keys to your users.  That means a hacker can get access to your db.

It would be much better to call Mongo from the Forge backend, thereby not exposing the key.  In the backend calls, there will also be no CORS errors.