Resolved: Fetch Blocked by CORS?

I’m experiencing the following error when trying to use my POST function from another Wix site.

Access to fetch at ‘https://www.mitchwagnerdesign.com/_functions/csv’ from origin ‘https://www.bedminsterptg.com’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled.

Please help me figure out why ‘Access-Control-Allow-Origin’: ‘*’ is not covering this.

http-function on https://www.mitchwagnerdesign.com

export function post_csv(request) {
 let options = {
        headers: {
 'Access-Control-Allow-Origin': '*',
 'Content-Type': 'application/json'
        }
    };return request.body.json()
        .then((body) => {
            body.expirationDate = new Date(new Date().getTime() + (24 * 60 * 60 * 1000))
 return wixData.insert("CSVExportData", body, {
 "suppressAuth": true,
 "suppressHooks": false
            });
        })
        .then((results) => {
            options.body = {
 "_id": results._id,
 "url": "https://www.mitchwagnerdesign.com/_functions/csv/" + results._id,
 "expiration": results.expirationDate
            };
            console.log("RETURNING DATA")
            console.log(options)
 return created(options);
        })
 // something went wrong
        .catch((error) => {
            options.body = {
 "error": error
            };
 return serverError(options);
        });

Calling the Method from https://www.bedminsterptg.com

fetch("https://www.mitchwagnerdesign.com/_functions/csv", {
            method: "post",
            headers: {
 "Content-Type": "text/plain"
            },
            body: '*******PRIVATE*DATA*REDACTED********'
        })
        .then((httpResponse) => {
            console.log("REQUEST SENT");
 if (httpResponse.ok) {
 return httpResponse.json();
            } else {
                $w("#buttonDownload").enable();
 return Promise.reject("Fetch did not succeed");
            }
        })
        .then((json) => {
            console.log(json);
            wixLocation.to(json.url);
            $w("#buttonDownload").enable();
        })
        .catch((err) => {
            console.log(err)
            $w("#buttonDownload").enable();
        });

I can’t find the fetch on https://www.bedminsterptg.com in the backend code. Do you have this in frontend code? If so, then that might be the cause of the problem. Also, in your post you redacted private information. If this code is the in the frontend, then anyone can see it.

Thank you for your help! I missed this, and was going in circles trying to figure out what was wrong. The “private information” is generated from database calls that can only be made from an admin account, but thanks for that catch as well.