I know that in our QA and production environments, our system admins can add CORS configuration to allow these requests. While developing in Visual Studio 2022 and using IIS Express, what can I do to keep from raising local CORS errors?

<script type='text/javascript'>
    function initEmbeddedMessaging() {
        try {
            embeddedservice_bootstrap.settings.language = 'en_US';

            embeddedservice_bootstrap.init(
                'someHexValue',
                'Some_Embedded_Service_deployment',
                'https://foobar.com/somepath',
                {
                    scrt2URL: 'https://foobaz.com'
                }
            );
        } catch (err) {
            console.error('Error loading Embedded Messaging: ', err);
        }
    };
</script>
<script type='text/javascript' src='https://foobar.com/somepath/assets/js/bootstrap.min.js' onload='initEmbeddedMessaging()'></script>

The errors being thrown are:

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://foobaz.com/embeddedservice/v1/embedded-service-config?orgId=someHexValue&esConfigName=Some_Embedded_Service_deployment&language=en_US. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing). Status code: 200.

Uncaught (in promise) Error: Unable to load Embedded Messaging configuration.
    h https://foobar.com/ESWAbleEmbeddedService1715712189606/assets/js/bootstrap.min.js:145

I have tried adding the following to <system.WebServer> in web.config (but I will probably remove it before proceeding to QA):

      <httpProtocol>
          <customHeaders>
              <remove name="X-Aspnet-Version" />
              <remove name="X-Aspnetmvc-Version" />
              <remove name="X-Powered-By" />
              <remove name="x-powered-by" />
              <remove name="x-aspnet-version" />
              <remove name="x-aspnetmvc-version" />
              <add name="Access-Control-Allow-Origin" value="https:foobar.com https://foobaz.com" />
              <add name="Access-Control-Allow-Methods" value="GET" />
              <add name="Access-Control-Allow-Headers" value="Content-Type" />
          </customHeaders>
      </httpProtocol>

TIA!