diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index e0093a2fb7af..a6a03cad6414 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -53,6 +53,7 @@ class Kernel extends HttpKernel
             'throttle:60,1',
             'bindings',
             'query_logging',
+            'cors',
             \App\Http\Middleware\StartupCheck::class,
         ],
         'contact' => [
@@ -108,5 +109,6 @@ class Kernel extends HttpKernel
         'password_protected' => \App\Http\Middleware\PasswordProtection::class,
         'signed' => \Illuminate\Routing\Middleware\ValidateSignature::class,
         'portal_enabled' => \App\Http\Middleware\ClientPortalEnabled::class,
+        'cors' => \App\Http\Middleware\Cors::class,
     ];
 }
diff --git a/app/Http/Middleware/Cors.php b/app/Http/Middleware/Cors.php
new file mode 100644
index 000000000000..9aa52fa164cb
--- /dev/null
+++ b/app/Http/Middleware/Cors.php
@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class Cors
+{
+    
+  public function handle($request, Closure $next)
+  {
+
+    return $next($request)
+      ->header('Access-Control-Allow-Origin', '*')
+      ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
+      ->header('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, X-Token-Auth, Authorization');
+
+  }
+
+}
\ No newline at end of file