I am working on an application with a completely decoupled front and back end. The front end has been implemented using Angular and the back end is implemented in Java using Spring extensively. Communication between the two is done via a Spring-managed Rest API. In addition to this, we have an external third party application(s) that also use this Rest API. So the API is used for two purposes: (1) as a "generic" API for an indeterminate number of clients and (2) as a very specific API designed specifically to meet the requirements of the Angular front end. We have separate Controllers to handle the separate concerns.
The problem I ran into was that of CORS. At the moment I have just annotated the Controllers with @CrossOrigin and that is fine for now but, I would need a more secure solution before we go live. I am aware that you can specify certain domains to limit when cross origin requests are allowed, however, that would not work for me. It would work if we just had the Angular front end to consider, but what about the external clients? There domains are not known. I almost need some sort of mechanism for the clients to authenticate and register themselves at runtime and then only these registered clients will be allowed to perform Cross Origin requests.
So that is what I am asking: given the above, what is the best solution to my problem? I need a solution that protects against Cross Site Request Forgery as well as meets my requirements stated previously.