We recently built a Angular 5 application that used Joomla as a backend service. The angular service was deployed on a primary domain, and Joomla was set up at a subdomain. The result, we now have CORS support. YAY!
We have now released com_api v2.3 that adds support for CORS. There are also a few other minor improvements, read on for more details.