create a REST API to access Rock tasks

And now using JS from your smartphone ;-)

CORS is a browser security feature which allows JavaScript only to open local resources of other pages (same port) so opening a webpage on localhost and accessing localhost:9292 is denied by browsers ad security measure, until the server at :9292 allows it specifically