I've been grappling with this for a while and figured I would post here to get input.
I am a full stack engineer. I work on both front end and back end apps, where sometimes I have to create new microservices, or sometimes I need to create new front end clients to already-existing microservices.
The front ends of these microservices live in different clients: sometimes multiple internal websites and external websites. For example, say I have an internal company website called internal-site.com. This site has its own front end and back end (I use Java so it'd be a Spring app). My service (which is Dockerized and usually a mix of Spring Boot and Vert.x) might live on a Docker Swarm or Kubernetes cluster on a different domain. I've usually been inclined to build my front end inside of my internal-site.com's code base because that is where users will log in and use the form(s) that interact with the respective service. My front end is usually going to be a Vue or Angular JS app, that uses a Spring controller on its back end to then call a microservice. The good thing about that is that I don't need to deal with any CORS issues, which has proven to be a real pain in the past.
The problem there is that whenever I need to make code changes to the front end, I have to re-deploy the entire internal-site.com in order to ship those changes.
As a partial solution to this problem, my team has started moving front end apps out of internal-site.com and into their respective microservices. Front end apps are compiled in our microservices, and an end point in the service will serve the compiled JS to whatever client calls that end point. A view from the client internal-site.com will have a basic page (JSP for Java apps) and a
<script> tag will call an endpoint on the back end of the client, that will then call the end point of the microservice and get the compiled JSP. With the back end of my client calling a microservice, we avoid CORS issues but still get the flexibility to deploy our front end apps without internal-site.com being a big dependency in their deployment.
But being that we still use a back end controller end point in our clients to call microservices, we are still somewhat dependent on the client if we need to make certain changes.
And of course, we have other sites that might have different front end frame works that use the service as well.
My overall question is, how should these types of situations be architected? Am I overthinking CORS, and just make my microservice calls directly from my front end apps to avoid having to make a client-side back end end point? Or do I leave as is? Or is there another way to architect this that I am not thinking of?