diff --git a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java
index 25270d2..1d49b01 100644
--- a/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java
+++ b/src/main/java/konturai/kz/api_gateway/filter/CorsHeaderFilter.java
@@ -10,62 +10,79 @@ import org.springframework.stereotype.Component;
 import org.springframework.web.server.ServerWebExchange;
 import reactor.core.publisher.Mono;
 
-import java.util.List;
-
 @Component
 public class CorsHeaderFilter implements GlobalFilter, Ordered {
 
     @Override
     public Mono<Void> filter(ServerWebExchange exchange, GatewayFilterChain chain) {
         ServerHttpRequest request = exchange.getRequest();
-        ServerHttpResponse response = exchange.getResponse();
-        
-        // Add CORS headers to response
-        HttpHeaders headers = response.getHeaders();
-        
-        // Remove any existing CORS headers to prevent duplication
-        headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
-        headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS);
-        headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS);
-        headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS);
-        headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE);
-        
-        // Get the origin from the request
-        String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
-        
-        // Set CORS headers based on the origin
-        if (origin != null && isAllowedOrigin(origin)) {
-            headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
-        } else {
-            headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz");
-        }
-        
-        headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS");
-        headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*");
-        headers.add(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
-        headers.add(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
-        
-        // Handle preflight requests
+
+        // Handle preflight requests immediately
         if (request.getMethod().name().equals("OPTIONS")) {
+            ServerHttpResponse response = exchange.getResponse();
+            HttpHeaders headers = response.getHeaders();
+
+            // Clear any existing CORS headers
+            headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
+            headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS);
+            headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS);
+            headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS);
+            headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE);
+
+            // Set CORS headers for preflight
+            String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
+            if (origin != null && isAllowedOrigin(origin)) {
+                headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+            } else {
+                headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz");
+            }
+
+            headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS");
+            headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*");
+            headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
+            headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
+
             response.setStatusCode(org.springframework.http.HttpStatus.OK);
             return Mono.empty();
         }
-        
-        return chain.filter(exchange);
+
+        // For non-preflight requests, process after the downstream service responds
+        return chain.filter(exchange).then(Mono.fromRunnable(() -> {
+            ServerHttpResponse response = exchange.getResponse();
+            HttpHeaders headers = response.getHeaders();
+
+            // Clear any existing CORS headers from downstream service
+            headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN);
+            headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS);
+            headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS);
+            headers.remove(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS);
+            headers.remove(HttpHeaders.ACCESS_CONTROL_MAX_AGE);
+
+            // Set our CORS headers
+            String origin = request.getHeaders().getFirst(HttpHeaders.ORIGIN);
+            if (origin != null && isAllowedOrigin(origin)) {
+                headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+            } else {
+                headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "https://konturai.kz");
+            }
+
+            headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET, POST, PUT, DELETE, OPTIONS");
+            headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "*");
+            headers.set(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
+            headers.set(HttpHeaders.ACCESS_CONTROL_MAX_AGE, "3600");
+        }));
     }
-    
+
     private boolean isAllowedOrigin(String origin) {
-        return origin != null && (
-            origin.equals("https://konturai.kz") ||
-            origin.startsWith("http://localhost:") ||
-            origin.startsWith("http://127.0.0.1:") ||
-            origin.startsWith("https://localhost:") ||
-            origin.startsWith("https://127.0.0.1:")
-        );
+        return origin != null && (origin.equals("https://konturai.kz") ||
+                origin.startsWith("http://localhost:") ||
+                origin.startsWith("http://127.0.0.1:") ||
+                origin.startsWith("https://localhost:") ||
+                origin.startsWith("https://127.0.0.1:"));
     }
 
     @Override
     public int getOrder() {
-        return -1; // High priority to run before other filters
+        return 1000; // Low priority to run after other filters and downstream services
     }
 }