diff --git a/module-auth/src/main/java/com/inhabas/api/auth/config/CorsConfig.java b/module-auth/src/main/java/com/inhabas/api/auth/config/CorsConfig.java
index 7d4e04ce..d57e9d95 100644
--- a/module-auth/src/main/java/com/inhabas/api/auth/config/CorsConfig.java
+++ b/module-auth/src/main/java/com/inhabas/api/auth/config/CorsConfig.java
@@ -12,6 +12,11 @@ public class CorsConfig implements WebMvcConfigurer {
 
   @Override
   public void addCorsMappings(CorsRegistry registry) {
-    registry.addMapping("/**").allowedOrigins("*").allowedMethods("*").allowedHeaders("*");
+    registry
+        .addMapping("/**")
+        .allowedOrigins("https://dev.inhabas.com")
+        .allowedMethods("OPTIONS", "GET", "POST", "PUT", "DELETE")
+        .allowedHeaders("Authorization")
+        .maxAge(3600);
   }
 }