We can use JavaScript to make client-side calls to a third-party website, provided the site is listed as CSP. It's always recommended to use the server-side Apex to make HTTP calls; however, with CSP configured in Salesforce you can make client-side calls. CSP ensures security against various web vulnerabilities.
The following example shows how can we use the JavaScript XMLHttpRequest (https://developer.mozilla.Org/en-US/docs/Web/API/XMLHttpRequest) to make GET requests. Note you can use this approach to make POST as well as PUT requests to any API that's HTTPS and CSP-protected.
In this example, we are making an API call to a public API that gives us the latest currency rates against ...
