How to call Salesforce public api from javascript in lightning

Question

I have created a public API in my org and I am trying to call from Javascript which is hosted as static resource in same org. But Salesforce refused to connect public api.

I have tried CORS, Remote Site Settings, CSP Setting.

async function getUserAsync(name) 
{
  let response = await fetch('https://<api url>/services/apexrest/api-ws/',
{
        method: 'POST',
        headers: {
            Accept: 'application/json',
            'Content-Type': 'application/json',
        },
        body: '{}'
    });
  let data = await response.json()
  return data;
}

getUserAsync()
  .then(data => console.log(data)); 

Refused to connect to 'https://api_url/services/apexrest/api-ws/' because it violates the following Content Security Policy directive: "connect-src 'self' https://org.lightning.force.com *.visualforce.com https://org.documentforce.com https://org_instance.salesforce.com".

PS: Might be it is not good approach but I have a specific requirement.

Answer 1

As per the Salesforce documentation -

Previous versions of lightning:container allowed developers to specify the Content Security Policy (CSP) of the iframed content. We removed this functionality for security reasons. The CSP level of all pages is now set to high. This value provides the greatest security, because content can only be loaded from secure, approved domains. When lightning:container is used in Communities, the CSP setting in that community will be respected.

https://developer.salesforce.com/docs/atlas.en-us.lightning.meta/lightning/container_limits.htm