CORS header 'Access-Control-Allow-Origin'

Security issues scare me.  It seems like a really easy place to make oneself look like an idiot.

Here is the scenario:  I have a web services service available. It is reachable over the internet (if one is inside the VPN) from a browser line at, say, _http://an.ibm.i/api/dayName/2019-03-15_ and returns:

dayOut "2019-03-15 is a Friday"

which is what I expect and want.

However if I use that link in an index.html on the same desktop I get  "Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://.../api/dayName/2019-03-15. (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).

OK.  I get it.  There is a security issue that is being solved. Good.

So I read about what to do and realize this is way out of my wheelhouse.  What have others done?