diff --git a/config/packages/nelmio_cors.yaml b/config/packages/nelmio_cors.yaml
index b725425..96e6871 100644
--- a/config/packages/nelmio_cors.yaml
+++ b/config/packages/nelmio_cors.yaml
@@ -1,7 +1,7 @@
 nelmio_cors:
   defaults:
     origin_regex: true
-    allow_origin: [ '*' ]
+    allow_origin: [ '%env(CORS_ALLOW_ORIGIN)%' ] # you can test locally with this value '^https?://(localhost|127\.0\.0\.1)(:[0-9]+)?$'
     allow_methods: [ 'GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE' ]
     allow_headers: [ '*' ]
     expose_headers: [ 'Authorization' ]