diff --git a/.env.example b/.env.example
index 9e945bc..e006411 100644
--- a/.env.example
+++ b/.env.example
@@ -5,3 +5,4 @@ MYSQL_PASSWORD=visione
 MYSQL_ROOT_PASSWORD=root
 MAILHOG_SMTP_PORT=1025
 MAILHOG_WEB_PORT=8025
+CORS_ALLOWED_ORIGIN=http://localhost:3000
diff --git a/common/Cors.cc b/common/Cors.cc
index 45881c5..6d1fc33 100644
--- a/common/Cors.cc
+++ b/common/Cors.cc
@@ -6,91 +6,33 @@ namespace visione::cors
 {
 namespace
 {
-std::vector<std::string> allowedOrigins()
+std::string allowedOrigin()
 {
-    auto cfg = drogon::app().getCustomConfig();
-    std::vector<std::string> origins;
-
-    if (cfg.isMember("cors") && cfg["cors"].isObject())
-    {
-        auto &c = cfg["cors"];
-        if (c.isMember("allowed_origin"))
-        {
-            auto &v = c["allowed_origin"];
-            if (v.isArray())
-            {
-                for (const auto &el : v)
-                {
-                    if (el.isString())
-                        origins.emplace_back(el.asString());
-                }
-            }
-            else if (v.isString())
-            {
-                origins.emplace_back(v.asString());
-            }
-        }
-    }
-
-    if (origins.empty())
-        origins.emplace_back("http://localhost:5173");
-
-    return origins;
+    return drogon::app()
+        .getCustomConfig()["cors"]
+        .get("allowed_origin", "http://localhost:5173")
+        .asString();
 }
 
 bool isAllowed(const drogon::HttpRequestPtr &request)
 {
-    auto origin = request->getHeader("Origin");
-    if (origin.empty())
-        return false;
-
-    auto origins = allowedOrigins();
-    for (const auto &o : origins)
-    {
-        if (o == "*" || o == origin)
-            return true;
-    }
-    return false;
+    return request->getHeader("Origin") == allowedOrigin();
 }
 
 void addHeaders(const drogon::HttpRequestPtr &request,
                 const drogon::HttpResponsePtr &response)
 {
-    auto origin = request->getHeader("Origin");
-    if (origin.empty())
-        return;
-
-    auto origins = allowedOrigins();
-    bool allowAll = false;
-    bool matched = false;
-    for (const auto &o : origins)
+    if (!isAllowed(request))
     {
-        if (o == "*")
-        {
-            allowAll = true;
-            break;
-        }
-        if (o == origin)
-        {
-            matched = true;
-            break;
-        }
+        return;
     }
 
-    if (!allowAll && !matched)
-        return;
-
-    if (allowAll)
-        response->addHeader("Access-Control-Allow-Origin", "*");
-    else
-        response->addHeader("Access-Control-Allow-Origin", origin);
-
+    response->addHeader("Access-Control-Allow-Origin", allowedOrigin());
     response->addHeader("Access-Control-Allow-Credentials", "true");
     response->addHeader("Access-Control-Allow-Methods",
                         "GET,POST,PATCH,DELETE,OPTIONS");
     response->addHeader("Access-Control-Allow-Headers",
                         "Authorization,Content-Type");
-    response->addHeader("Vary", "Origin");
 }
 }  // namespace
 
diff --git a/config.json b/config.json
index e7bfd4d..88791df 100644
--- a/config.json
+++ b/config.json
@@ -63,7 +63,7 @@
       "spec_path": "build/openapi/visione.openapi.json"
     },
     "cors": {
-      "allowed_origin": ["http://localhost:3000", "http://localhost:5137"]
+      "allowed_origin": "http://localhost:3000"
     }
   }
 }
\ No newline at end of file
diff --git a/main.cc b/main.cc
index 7854cc0..73406e2 100644
--- a/main.cc
+++ b/main.cc
@@ -34,7 +34,8 @@ int main()
             config["custom_config"]["mail"]["smtp_host"] = envSmtpHost;
         if (const char* envSmtpPort = std::getenv("SMTP_PORT"))
             config["custom_config"]["mail"]["smtp_port"] = std::stoi(envSmtpPort);
-
+        if (const char* envCorsAllowedOrigin = std::getenv("CORS_ALLOWED_ORIGIN"))
+            config["custom_config"]["cors"]["allowed_origin"] = envCorsAllowedOrigin;
         drogon::app().loadConfigJson(config);
     }
     else