I do a lot of API stuff from forms.  Nothing too overly complete, these are usually managed by a button that a user clicks that does a simple API call to another system.  An example is adding a note to an account in our accounting system.

I have a couple dozen processes in the Classic Designer that have various API connections like this.  And they work well.

But I'm always trying to see what I can get get working in the Modern Designer, and this is one that I consistently have been unable to make work.

The primary issue I have is that these APIs limit the origins of calls to them.  These are all set-up so that they allow the origin to be the server that is hosting the forms environment or in a couple cases they are running on the same server.  That works for the Classic Designer because the Javascript runs directly on the form and the origin is the server address.

But in the case of the Modern Designer, the Javascript runs in a sandboxed iFrame, which means the origin always shows as NULL.  This results in any attempted calls to these APIs failing with a message like "Access to fetch at '{URL}' from origin 'null' has been blocked by CORS."

We could set the Access-Control-Allow-Origin header on the APIs to allow NULL origin, but that is risky as it opens the server up to anything.

There is an option for the iFrame sandbox called allow-same-origin which would mean the sandbox showed the same origin as the parent window instead of showing NULL.  I have no idea if Laserfiche would be willing to modify the functionality to enable that option on the sandbox or not.  But I'm wondering if they would be willing to consider it?

Or if anyone has any better suggestions?