diff --git a/src/createApp.js b/src/createApp.js
index f507751..68ad950 100644
--- a/src/createApp.js
+++ b/src/createApp.js
@@ -9,7 +9,13 @@ const config = require('./config'),
 
 function createApp() {
     const app = express();
-    app.use(cors());
+    const allowedOrigins = process.env.ALLOWED_ORIGINS
+        ? process.env.ALLOWED_ORIGINS.split(',').map(o => o.trim())
+        : [];
+    app.use(cors({
+        origin: allowedOrigins.length > 0 ? allowedOrigins : false,
+        credentials: true
+    }));
     app.use(express.json());
     app.use(express.urlencoded({ extended: true }));
     app.use(require('method-override')());