diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index acd42e557681..9ea24c11e5f8 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -24,6 +24,7 @@ class Kernel extends HttpKernel
         \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
         \App\Http\Middleware\SecurityHeaders::class,
         \App\Http\Middleware\PreventBackHistory::class,
+        \Fruitcake\Cors\HandleCors::class,
 
     ];
 
@@ -44,7 +45,6 @@ class Kernel extends HttpKernel
         ],
 
         'api' => [
-            \Fruitcake\Cors\HandleCors::class,
             'throttle:120,1',
             'auth:api',
         ],
diff --git a/config/cors.php b/config/cors.php
index f09ab4979ff4..083ee3093413 100644
--- a/config/cors.php
+++ b/config/cors.php
@@ -1,10 +1,14 @@
 <?php
 
+$allowed_origins = env('CORS_ALLOWED_ORIGINS') !== null ?
+    explode(',', env('CORS_ALLOWED_ORIGINS')) : [];
+
+
 return [
 
     'supportsCredentials' => false,
 
-    'allowedOrigins' => ['*'],
+    'allowedOrigins' => $allowed_origins,
 
     'allowedHeaders' => ['*'],