diff --git a/config/cors.php b/config/cors.php
index f09ab4979f..083ee30934 100644
--- a/config/cors.php
+++ b/config/cors.php
@@ -1,10 +1,14 @@
 <?php
 
+$allowed_origins = env('CORS_ALLOWED_ORIGINS') !== null ?
+    explode(',', env('CORS_ALLOWED_ORIGINS')) : [];
+
+
 return [
 
     'supportsCredentials' => false,
 
-    'allowedOrigins' => ['*'],
+    'allowedOrigins' => $allowed_origins,
 
     'allowedHeaders' => ['*'],