Assume that you have a web application. The backend API is deployed at api.example.com
and your frontend SPA is deployed at frontend.example.com
. When you open it you download all the resources to your browser. The origin is frontend.example.com
, yet when you are sending requests to the backend they are actually sent to api.example.com
which is not the same origin.
So an SPA naturally breaks the same-origin policy since in most cases the API it works against is not the origin it stands on. So my question is, is there a way to develop a SPA without breaking the same-origin policy, and without using some tricky tech like CORS or JSONP?