Microservices largely break the standard HTTP patterns anyway. E.g. you are supposed to redirect after a POST request so that users can't double submit a form,

Microservices largely break the standard HTTP patterns anyway. E.g. you are supposed to redirect after a POST request so that users can't double submit a form, but if you're hosting your frontend on a CDN then this isn't possible because the CORS spec prevents browsers from honoring redirect responses except for after GET and HEAD requests. Incidentally, you are supposed to be allowed to redirect in response to GET requests, but if you use JWT auth then you can't even do this because the non-standard header forces a preflight request, and CORS requests with preflight aren't allowed to redirect at all. I don't even understand how it's supposedly secure to pass back JSON with a URL for your promise to trigger a redirect, but it's insecure to pass your browser a 3XX response to do the same thing automatically.