diff --git a/myice/webapi.py b/myice/webapi.py
index 4edb83e..ed3ff02 100644
--- a/myice/webapi.py
+++ b/myice/webapi.py
@@ -26,16 +26,19 @@ ALLOWED_USERS = (
     else []
 )
 
-origins = ["*"]
-
+origins = (
+    os.environ.get("ALLOWED_ORIGINS", "").split(",")
+    if os.environ.get("ALLOWED_ORIGINS")
+    else []
+)
 app = FastAPI()
 
 app.add_middleware(
     CORSMiddleware,
     allow_origins=origins,
     allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
+    allow_methods=["GET", "POST"],
+    allow_headers=["Authorization", "Content-Type"],
 )
 
 block_endpoints = ["/health"]