diff --git a/.env.sample b/.env.sample
index 57b0683..edeabfa 100644
--- a/.env.sample
+++ b/.env.sample
@@ -3,6 +3,8 @@ MAST_CLIENT="<your client id>"
 MAST_SECRET="<your client key>"
 MAST_SCOPE="read:accounts"
 
+FRONTEND_WHITELIST="https://hole-thu.github.io"
+
 DATABASE_URL="postgres://hole:hole_pass@localhost/hole_v2"
 MIGRATION_DIRECTORY=migrations/postgres
 REDIS_URL="redis://127.0.0.1:6379"
diff --git a/src/main.rs b/src/main.rs
index 8bb7d1a..5193705 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -12,6 +12,7 @@ extern crate log;
 
 mod api;
 mod cache;
+mod cors;
 mod db_conn;
 mod libs;
 #[cfg(feature = "mastlogin")]
@@ -98,6 +99,13 @@ async fn main() -> Result<(), rocket::Error> {
         .manage(RandomHasher::get_random_one())
         .manage(rmc)
         .attach(Db::fairing())
+        .attach(cors::CORS {
+            whitelist: env::var("FRONTEND_WHITELIST")
+                .unwrap_or_default()
+                .split(',')
+                .map(|s| s.to_string())
+                .collect::<Vec<String>>(),
+        })
         .launch()
         .await
 }