diff --git a/src/main/java/kz/konturai/parser/config/CorsProperties.java b/src/main/java/kz/konturai/parser/config/CorsProperties.java
new file mode 100644
index 0000000..39a883e
--- /dev/null
+++ b/src/main/java/kz/konturai/parser/config/CorsProperties.java
@@ -0,0 +1,67 @@
+package kz.konturai.parser.config;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+@ConfigurationProperties(prefix = "cors")
+public class CorsProperties {
+
+    private List<String> allowedOrigins = new ArrayList<>(
+            List.of("https://konturai.kz", "https://www.konturai.kz"));
+    private List<String> allowedMethods = new ArrayList<>(
+            List.of("GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"));
+    private List<String> allowedHeaders = new ArrayList<>(List.of("*"));
+    private List<String> exposedHeaders = new ArrayList<>(List.of("Location", "Content-Disposition"));
+    private boolean allowCredentials = true;
+    private long maxAgeSeconds = 3600;
+
+    public List<String> getAllowedOrigins() {
+        return allowedOrigins;
+    }
+
+    public void setAllowedOrigins(List<String> allowedOrigins) {
+        this.allowedOrigins = allowedOrigins;
+    }
+
+    public List<String> getAllowedMethods() {
+        return allowedMethods;
+    }
+
+    public void setAllowedMethods(List<String> allowedMethods) {
+        this.allowedMethods = allowedMethods;
+    }
+
+    public List<String> getAllowedHeaders() {
+        return allowedHeaders;
+    }
+
+    public void setAllowedHeaders(List<String> allowedHeaders) {
+        this.allowedHeaders = allowedHeaders;
+    }
+
+    public List<String> getExposedHeaders() {
+        return exposedHeaders;
+    }
+
+    public void setExposedHeaders(List<String> exposedHeaders) {
+        this.exposedHeaders = exposedHeaders;
+    }
+
+    public boolean isAllowCredentials() {
+        return allowCredentials;
+    }
+
+    public void setAllowCredentials(boolean allowCredentials) {
+        this.allowCredentials = allowCredentials;
+    }
+
+    public long getMaxAgeSeconds() {
+        return maxAgeSeconds;
+    }
+
+    public void setMaxAgeSeconds(long maxAgeSeconds) {
+        this.maxAgeSeconds = maxAgeSeconds;
+    }
+}
diff --git a/src/main/java/kz/konturai/parser/config/WebCorsConfig.java b/src/main/java/kz/konturai/parser/config/WebCorsConfig.java
new file mode 100644
index 0000000..83f1209
--- /dev/null
+++ b/src/main/java/kz/konturai/parser/config/WebCorsConfig.java
@@ -0,0 +1,28 @@
+package kz.konturai.parser.config;
+
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.CorsRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+@Configuration
+@EnableConfigurationProperties(CorsProperties.class)
+public class WebCorsConfig implements WebMvcConfigurer {
+
+    private final CorsProperties corsProperties;
+
+    public WebCorsConfig(CorsProperties corsProperties) {
+        this.corsProperties = corsProperties;
+    }
+
+    @Override
+    public void addCorsMappings(CorsRegistry registry) {
+        registry.addMapping("/**")
+                .allowedOrigins(corsProperties.getAllowedOrigins().toArray(String[]::new))
+                .allowedMethods(corsProperties.getAllowedMethods().toArray(String[]::new))
+                .allowedHeaders(corsProperties.getAllowedHeaders().toArray(String[]::new))
+                .exposedHeaders(corsProperties.getExposedHeaders().toArray(String[]::new))
+                .allowCredentials(corsProperties.isAllowCredentials())
+                .maxAge(corsProperties.getMaxAgeSeconds());
+    }
+}
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index 04ca85c..82e77f2 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -12,6 +12,12 @@ minio.bucket-name=konturai
 java.awt.headless=true
 spring.application.name=parser
 
+cors.allowed-origins=${CORS_ALLOWED_ORIGINS:${CORS_ALLOWED_ORIGIN:https://konturai.kz,https://www.konturai.kz}}
+cors.allowed-methods=${CORS_ALLOWED_METHODS:GET,POST,PUT,PATCH,DELETE,OPTIONS}
+cors.allowed-headers=${CORS_ALLOWED_HEADERS:*}
+cors.exposed-headers=${CORS_EXPOSED_HEADERS:Location,Content-Disposition}
+cors.allow-credentials=${CORS_ALLOW_CREDENTIALS:true}
+cors.max-age-seconds=${CORS_MAX_AGE_SECONDS:3600}
 
 spring.data.mongodb.host=92.38.48.166
 spring.data.mongodb.port=27017