If the application is strictly for personal or trusted use that's fine. If you intend to publish it to users, you shouldn't publicly expose the gateway to call it from the browser directly (otherwise anyone can make inference calls).

For security reasons, we won't mess with CORS in the gateway directly. You can do this by setting up a proxy service like Nginx in front of your gateway. Alternatively, you can call the gateway from a minimal backend service, and call this backend service from your browser.