Hello @Akshata Purshottam Palsule
Your case looks like 3-Tier Application architecture - Frontend -> Backend -> Database.
The web and business tiers are stateless. The data tier should consist of a database.
Multi-tier web application which is a front-end web application that calls API applications behind it. This reference architecture showcases how to use service endpoints for secure communications between app services in a multi-tier environment.
The web app can securely connect to a backend database over a fully private connection. The public internet can't reach the database, which eliminates a common attack vector.
You can configure CORS settings in your WebApp. Here is CORS Q&A answer that explains it