Many long (and correct) answers here. But usually you won't do these things manually - at least not when you set up your first projects for development (this is where you usually stumble upon these things). If you use koa for the backend: use koa-cors. Install via npm...
npm install --save koa-cors
...and use it in the code:
const cors = require('koa-cors');
const Koa = require('koa');
const app = new Koa();
app.use(cors());
problem solved.