diff --git a/.env.example b/.env.example
index dd0e4e6..fca8fe3 100755
--- a/.env.example
+++ b/.env.example
@@ -52,3 +52,4 @@ MIX_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
 MIX_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
 
 SANCTUM_STATEFUL_DOMAINS=yxbd-fangke.ali251.langye.net,localhost,127.0.0.1,127.0.0.1:8020
+CORS_ALLOWED_ORIGINS=https://yxbd-fangke.ali251.langye.net,http://localhost:8020,http://127.0.0.1:8020
diff --git a/config/cors.php b/config/cors.php
index 8a39e6d..a3b4e8d 100755
--- a/config/cors.php
+++ b/config/cors.php
@@ -19,7 +19,10 @@ return [
 
     'allowed_methods' => ['*'],
 
-    'allowed_origins' => ['*'],
+    'allowed_origins' => array_filter(array_map('trim', explode(',', env(
+        'CORS_ALLOWED_ORIGINS',
+        'https://yxbd-fangke.ali251.langye.net,http://localhost:8020,http://127.0.0.1:8020'
+    )))),
 
     'allowed_origins_patterns' => [],
 
@@ -29,6 +32,6 @@ return [
 
     'max_age' => 0,
 
-    'supports_credentials' => false,
+    'supports_credentials' => true,
 
 ];