I've service running my colleagues workstations locally (127.0.0.1), and I would like to call that service when they visit mysite.com, but I do have a strict CSP rule to enforce that no CORS is allowed.

CSP Error

Refused to connect to 'http://127.0.0.1/api/verify' because it violates the following Content Security Policy directive: "connect-src 'self'

I understand I can relax my CSP rules to allow connect-src: 127.0.0.1, but I would like to check with the community on whether there is an alternative mechanism to call the local service without update CSP rules.

Note: I have multiple sites that call the local service.