diff --git a/CHANGELOG.md b/CHANGELOG.md
index 48a7023..bcf84f7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Added all ports on localhost, 127.0.0.1 and 0.0.0.0 to CORS allowed origins.
 ### Changed
 - Altered the `/api/recent_routes` endpoint to return routes from the last 24 hours. Previously it returned routes from the current calendar day.
 
diff --git a/polarrouteserver/settings/base.py b/polarrouteserver/settings/base.py
index 8aecdfc..77caf4a 100644
--- a/polarrouteserver/settings/base.py
+++ b/polarrouteserver/settings/base.py
@@ -29,6 +29,7 @@
 ALLOWED_HOSTS = [
     "localhost",
     "0.0.0.0",
+    "127.0.0.1",
 ]
 if os.getenv("POLARROUTE_ALLOWED_HOSTS", None) is not None:
     ALLOWED_HOSTS.extend(os.getenv("POLARROUTE_ALLOWED_HOSTS").split(","))
@@ -96,10 +97,17 @@
     "corsheaders",
 ]
 
-CORS_ALLOWED_ORIGINS = ["http://localhost:8000"]
+CORS_ALLOWED_ORIGINS = []
 if os.getenv("POLARROUTE_CORS_ALLOWED_ORIGINS", None) is not None:
     CORS_ALLOWED_ORIGINS.extend(os.getenv("POLARROUTE_CORS_ALLOWED_ORIGINS").split(","))
 
+# Allow all localhost origins for CORS in development
+CORS_ALLOWED_ORIGIN_REGEXES = [
+    r"^(?:https*:\/\/)*localhost:\d{2,4}$",  # matches localhost with or without http(s):// and a port of 2-4 digits
+    r"^(?:https*:\/\/)*127.0.0.1:\d{2,4}$",  # same for 127.0.0.1
+    r"^(?:https*:\/\/)*0.0.0.0:\d{2,4}$",  # same for 0.0.0.0
+]
+
 CORS_ALLOW_METHODS = ("DELETE", "GET", "POST", "OPTIONS")
 
 MIDDLEWARE = [