diff --git a/pkg/api/server/cors.go b/pkg/api/server/cors.go
index f9a0a6c74..e570dbd99 100644
--- a/pkg/api/server/cors.go
+++ b/pkg/api/server/cors.go
@@ -9,9 +9,24 @@ import (
 // Sets up default CORS rules to use as a middleware
 func handleCORS(next http.Handler) http.Handler {
 	return cors.New(cors.Options{
-		AllowedOrigins:   []string{"*"},
-		AllowedMethods:   []string{"GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"},
-		AllowedHeaders:   []string{"Accept", "Authorization", "Content-Type", "X-CSRF-ID"},
+		AllowedOrigins: []string{
+			"http://*",
+			"https://*",
+		},
+		AllowedMethods: []string{
+			http.MethodHead,
+			http.MethodGet,
+			http.MethodPost,
+			http.MethodPut,
+			http.MethodPatch,
+			http.MethodDelete,
+		},
+		AllowedHeaders: []string{
+			"Accept",
+			"Authorization",
+			"Content-Type",
+			"X-CSRF-ID",
+		},
 		AllowCredentials: true,
 		MaxAge:           300, // Maximum value not ignored by any of major browsers
 	}).Handler(next)