Not receiving a satisfactory answer, after thinking quite a bit about the issue myself, I provide hereafter my conclusions:
- Development
- Use a "production-like" server (Apache, lighttpd, ...) to serve real PHP pages.
Use absolute urls with $http or $request to access that server (distinct from Grunt, which serves angular.js pages). The urls will be easily configurable, to require only a minimum work (and possible errors) to switch to production.
- In PHP scripts, before producing (JSON) output, always output a proper "Access-Control-Allow-Origin" header; the value of the directive will also be easily configurable.
- Production
- Deploy angular.js app to the same server where PHP is deployed.
- Change the urls, and make them relative, since now they share the same origin with client-side scripts.
- Change the "Access-Control-Allow-Origin" header, to allow only local requests (or possibly remove that header at all...).