diff --git a/arbisoft_sessions_portal/settings/base.py b/arbisoft_sessions_portal/settings/base.py
index 8d7f954..44590ae 100644
--- a/arbisoft_sessions_portal/settings/base.py
+++ b/arbisoft_sessions_portal/settings/base.py
@@ -78,7 +78,13 @@
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
 ]
 
-CORS_ORIGIN_ALLOW_ALL = True
+CORS_ALLOWED_ORIGINS = [
+    "https://sessions.arbisoft.com",
+]
+
+# Enable this for development
+# CORS_ORIGIN_ALLOW_ALL = True
+
 CORS_ALLOW_CREDENTIALS = True
 
 ROOT_URLCONF = 'arbisoft_sessions_portal.urls'