diff --git a/backend/cmd/main.go b/backend/cmd/main.go
index 6baebd0..26e87a1 100644
--- a/backend/cmd/main.go
+++ b/backend/cmd/main.go
@@ -130,6 +130,7 @@ func main() {
 	}
 
 	router := gin.Default()
+	router.Use(handlers.CorsMiddleware("http://127.0.0.1:5173;http://localhost:5173"))
 	docs.SwaggerInfo.BasePath = "/api/v1"
 	docs.SwaggerInfo.Title = "HellreigN"
 	docs.SwaggerInfo.Version = "1.0"
diff --git a/backend/go.mod b/backend/go.mod
index 002149b..8951022 100644
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -6,6 +6,7 @@ require (
 	gitea.d3m0k1d.ru/d3m0k1d/HellreigN/proto v0.0.0-20260403210401-a6212c89fc0e
 	github.com/ClickHouse/clickhouse-go/v2 v2.44.0
 	github.com/gin-gonic/gin v1.12.0
+	github.com/samber/lo v1.53.0
 	github.com/swaggo/files v1.0.1
 	github.com/swaggo/gin-swagger v1.6.1
 	github.com/swaggo/swag v1.16.6
diff --git a/backend/go.sum b/backend/go.sum
index f229a25..da201d1 100644
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -138,6 +138,8 @@ github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rogpeppe/go-internal v1.10.0 h1:TMyTOH3F/DB16zRVcYyreMH6GnZZrwQVAoYjRBZyWFQ=
 github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncjaFoBhdsK/akog=
+github.com/samber/lo v1.53.0 h1:t975lj2py4kJPQ6haz1QMgtId2gtmfktACxIXArw3HM=
+github.com/samber/lo v1.53.0/go.mod h1:4+MXEGsJzbKGaUEQFKBq2xtfuznW9oz/WrgyzMzRoM0=
 github.com/segmentio/asm v1.2.1 h1:DTNbBqs57ioxAD4PrArqftgypG4/qNpXoJx8TVXxPR0=
 github.com/segmentio/asm v1.2.1/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
diff --git a/backend/internal/handlers/cors.go b/backend/internal/handlers/cors.go
new file mode 100644
index 0000000..ab266c6
--- /dev/null
+++ b/backend/internal/handlers/cors.go
@@ -0,0 +1,33 @@
+package handlers
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+	"github.com/samber/lo"
+)
+
+func CorsMiddleware(origincfg string) gin.HandlerFunc {
+	origins := strings.Split(origincfg, ";")
+	if origins[0] == "" {
+		panic("zero cors origins wtf is your config")
+	}
+	return func(c *gin.Context) {
+		origin := c.GetHeader("Origin")
+		if !lo.Contains(origins, origin) {
+			origin = origins[0]
+		}
+		c.Writer.Header().Set("Access-Control-Allow-Origin", origin)
+		// c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
+		c.Writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Accept-Encoding, Authorization")
+		c.Writer.Header().Set("Access-Control-Allow-Methods", "OPTIONS, GET, POST, PATCH, DELETE, PUT")
+
+		if c.Request.Method == "OPTIONS" {
+			c.AbortWithStatus(http.StatusNoContent)
+			return
+		}
+
+		c.Next()
+	}
+}