diff --git a/Gemfile b/Gemfile
index d5c7affd..d837ba0e 100644
--- a/Gemfile
+++ b/Gemfile
@@ -37,6 +37,8 @@ gem 'jbuilder', '~> 2.5'
 
 gem 'will_paginate'
 
+gem 'rack-cors', :require => 'rack/cors'
+
 group :development, :test do
   # Call 'byebug' anywhere in the code to stop execution and get a debugger console
   gem 'byebug', platform: :mri
diff --git a/Gemfile.lock b/Gemfile.lock
index b39604fa..f80bcea9 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -119,6 +119,7 @@ GEM
       pry (>= 0.9.10)
     puma (3.6.2)
     rack (2.0.1)
+    rack-cors (0.4.1)
     rack-test (0.6.3)
       rack (>= 1.0)
     rails (5.0.1)
@@ -208,6 +209,7 @@ DEPENDENCIES
   minitest-spec-rails
   pry-rails
   puma (~> 3.0)
+  rack-cors
   rails (~> 5.0.1)
   sass-rails (~> 5.0)
   spring
diff --git a/app/controllers/movies_controller.rb b/app/controllers/movies_controller.rb
index 362e2791..0fdc0d41 100644
--- a/app/controllers/movies_controller.rb
+++ b/app/controllers/movies_controller.rb
@@ -11,6 +11,20 @@ def index
     render status: :ok, json: data
   end
 
+  def create
+    movie = Movie.new(movie_params)
+    if movie.save
+      render json: movie.as_json, status: :ok
+    else
+      render json: {errors: {movie: ["Unable to add to #{params[:title]} your Movie Store!"]} }
+    end
+    # create new movie with title
+    # Save it to DB.
+    # Send it to front end backbone.
+    # Add to collecction
+    # Rerender.
+  end
+
   def show
     render(
       status: :ok,
@@ -23,6 +37,10 @@ def show
 
   private
 
+  def movie_params
+    params.require(:movie).permit(:title, :overview, :release_date, :image_url)
+  end
+
   def require_movie
     @movie = Movie.find_by(title: params[:title])
     unless @movie
diff --git a/config/application.rb b/config/application.rb
index 2ac21a62..9f8a6f91 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -15,9 +15,11 @@ class Application < Rails::Application
     #this loads everything in the lib folder automatically
     config.eager_load_paths << Rails.root.join('lib')
 
-    config.action_dispatch.default_headers = {
-      'Access-Control-Allow-Origin' => 'http://localhost:8081',
-      'Access-Control-Request-Method' => %w{GET POST OPTIONS}.join(",")
-    }
+    config.middleware.insert_before 0, Rack::Cors do
+      allow do
+        origins '*'
+        resource '*', :headers => :any, :methods => [:get, :post, :put, :delete, :options]
+      end
+    end
   end
 end