diff --git a/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilter.java b/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilter.java
index 1a2a45c444e..3e27aae2f86 100644
--- a/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilter.java
+++ b/jans-auth-server/server/src/main/java/io/jans/as/server/filter/CorsFilter.java
@@ -27,8 +27,10 @@
 import java.io.IOException;
 import java.net.URLDecoder;
 import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.List;
 
 /**
@@ -104,7 +106,7 @@ public void init(final FilterConfig filterConfig) throws ServletException {
     @Override
     public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
             throws IOException, ServletException {
-        Collection<String> globalAllowedOrigins = null;
+        Collection<String> globalAllowedOrigins = new ArrayList<>(0);
         if (this.filterEnabled) {
             try {
                 globalAllowedOrigins = doFilterImpl(servletRequest);