I do not have time to write a full answer, but this option should do the trick (and will not require you to disable CORS locally): angular.io/guide/build#proxying-to-a-backend-server - Basically you will allow your frontend to issue the calls to localhost:4200/api, but have angular rewrite the outgoing call to localhost:XXX/api and disable CORS on the way automatically for development purposes.
localhost:4200/api, but have angular rewrite the outgoing call tolocalhost:XXX/apiand disable CORS on the way automatically for development purposes.