CORS support in IBM Datapower or Java Spring Application only?

We have Java Spring web application providing Restful webservices (JSON). All requests are proxied thru Datapower for Basic Authentication. These services are being invoked from native iOS Apps and everything works fine.

We are now building a Hybrid App that consume the same services. I am getting a CORS error when trying to invoke the same services using Angular $http.post(). I was able to overcome this by adding a CORS Filter on the Java Web Application on my local development machine and it seems to work.

I was wondering if that is the way to go or if there is anything that we can do on the Datapower appliance to accomplish the same that would eliminate the need to update the Java Web App.