Disable Web Security?

[KiddoV]

I came across a problem with CORS policy when trying to send request to an API from front-end (I am not in control of the API). The API link is working find when I paste directly to the browser, or Postman.
It failed when I use JQuery to do the request:

Access to XMLHttpRequest at 'https://xxx.com/api/components/10001101L/extraInfo/' from origin 'http://wails.localhost' 
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Tried to add many header:

        "Access-Control-Allow-Origin": "*",
        "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, POST, DELETE, OPTIONS",
        "Access-Control-Allow-Headers": "Origin, Content-Type, Accept, Authorization, X-Request-With",
        "Authorization": "Basic " + btoa("user:pass"),

Still it didn't help...

My question is can we somehow disable all the web security using flag--disable-web-security some where in Webview2?

[leaanthony]

Could you just make this call from Go?

We are looking to do a pass-through of webview2 flags but that's not a cross platform solution

[KiddoV]

I use Fomantic-UI lib to call the api. It is well designed to call API from the front-end, so I wouldn't stop using it unless I have to. Is there any work-around to pass this?