In production, you’d end up running each of the JSON APIs behind a reverse proxy to terminate SSL and deal with CORS so your questions is only relevant to development I think. And for development, you can get rid of CORS using CORS Anywyere. It’s a dynamic reverse proxy that just allows you to make requests from anywhere to anywhere. Since we don’t use any cookies, this Should Just Work™.