diff --git a/conf/dev.conf.example b/conf/dev.conf.example
index dceca45..fff557e 100644
--- a/conf/dev.conf.example
+++ b/conf/dev.conf.example
@@ -1,6 +1,7 @@
 [WEB]
 DEBUG = true
 SECRET_KEY = helloworld
+CROSS_ORIGIN_URLS = ['http://localhost:1909']
 
 [DATABASE]
 URL = postgresql://localhost:5432/word-way
diff --git a/conf/prod.conf b/conf/prod.conf
index ec3a6f1..4463950 100644
--- a/conf/prod.conf
+++ b/conf/prod.conf
@@ -1,6 +1,7 @@
 [WEB]
 DEBUG = false
 SECRET_KEY = Rx_gFkK9pUYKY-hNoODBlA
+CROSS_ORIGIN_URLS = ['http://localhost:1909']
 
 [DATABASE]
 URL = postgresql://localhost:5432/word-way
diff --git a/requirements.txt b/requirements.txt
index 193e120..2ee8347 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,7 @@
 alembic >= 1.3.0, < 1.4.0
 celery >= 4.4.2, < 4.5.0
 Flask >= 1.1.1, < 1.2.0
+Flask-Cors >= 3.0.8, < 3.1.0
 gevent >= 1.4.0, < 1.5.0
 nltk >= 3.4.5, < 3.5.0
 psycopg2 >= 2.8.0, < 2.9.0
diff --git a/word_way/app.py b/word_way/app.py
index d14f514..7177456 100644
--- a/word_way/app.py
+++ b/word_way/app.py
@@ -2,6 +2,7 @@
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 """
 from flask import Flask
+from flask_cors import CORS
 from typeguard import typechecked
 
 from word_way.api import api
@@ -19,4 +20,6 @@ def create_app(config_name: str) -> Flask:
     config = load_config(config_name)
     app.config.update(config['WEB'])
     app.config['APP_CONFIG'] = config
+    CORS(app, origins=config['WEB']['CROSS_ORIGIN_URLS'])
+
     return app