I have several backends services (REST+SOAP) that have to be consumed by an SPA (Single Page Angular2 App).
As JWT (JSON Web Token) is not feasible for me for the moment, security is done using CAS Central Authentication Service ( single sign-on protocol ).
In order to avoid CORS (The Cross-Origin Resource Sharing) and to have security in one place, I am thinking of creating a layer that will be accessible directly by the client and from that layer make each REST call. Something like a proxy that will just pass through the client requests.
This I see it as a custom API Gatway pattern implementation as I am not using an API Management tool.
Do you see any disadvantage to this solution?