Assume that you have a web application. The backend API is deployed at
api.example.com and your frontend SPA is deployed at
frontend.example.com. When you open it you download all the resources to your browser. The origin is
frontend.example.com, yet when you are sending requests to the backend they are actually sent to
api.example.com which is not the same origin.
So an SPA naturally breaks the same-origin policy since in most cases the API it works against is not the origin it stands on. So my question is, is there a way to develop a SPA without breaking the same-origin policy, and without using some tricky tech like CORS or JSONP?