super minor but unless I'm mistaken SPA stands for "Single Page Application", so the first sentence in the post is a bit jarring:

> AlphaSights’ recruitment platform evolved from a Rails application into a _classic SPA app_.

Update 20s later: is "Wepack" in the diagram supposed to be "Webpack"?

Update 60s later: Can you explain _what_ you're actually using that runs into CORS issues? Are browsers talking to the api.* address directly? The diagram seems to imply that all api.* communication is routed through app.*, in which case CORS wouldn't be an issue, right?