What is the best approach to use CORS, should it be configured using API gateway policy using API Manager or configured in the application in each HTTPS Listener.
The best approach is using the API Gateway policy since this will allow you to be as granular as you like and to enable or disable CORS easily without even redeploying your app. If you configure it at the listener level, any changes will require modifying your app and redeploying it, which will make it harder to maintain. HTH