diff --git a/surfsense_backend/.env.example b/surfsense_backend/.env.example
index 467078219..f936208a3 100644
--- a/surfsense_backend/.env.example
+++ b/surfsense_backend/.env.example
@@ -32,8 +32,10 @@ AUTH_TYPE=LOCAL
 REGISTRATION_ENABLED=TRUE or FALSE
 
 # CORS Configuration (comma-separated list of allowed origins)
-# Use * to allow all origins, or specify domains like: https://example.com,https://app.example.com
-CORS_ORIGINS=*
+# WARNING: Do not use "*" - it's incompatible with credentials and insecure for production
+# Defaults to NEXT_FRONTEND_URL if not set
+# Example: CORS_ORIGINS=https://example.com,https://app.example.com
+# CORS_ORIGINS=http://localhost:3000
 
 # Google OAuth Credentials (OPTIONAL - Required only for Gmail and Google Calendar connectors)
 GOOGLE_OAUTH_CLIENT_ID=your_google_client_id
diff --git a/surfsense_backend/app/config/__init__.py b/surfsense_backend/app/config/__init__.py
index df2744f4d..1fa9d3f33 100644
--- a/surfsense_backend/app/config/__init__.py
+++ b/surfsense_backend/app/config/__init__.py
@@ -136,8 +136,9 @@ class Config:
     REGISTRATION_ENABLED = os.getenv("REGISTRATION_ENABLED", "TRUE").upper() == "TRUE"
 
     # CORS Configuration
-    # Comma-separated list of allowed origins, defaults to all origins if not set
-    _cors_origins_str = os.getenv("CORS_ORIGINS", "*")
+    # Comma-separated list of allowed origins, defaults to frontend URL
+    # Note: Wildcard "*" is not allowed when allow_credentials=True
+    _cors_origins_str = os.getenv("CORS_ORIGINS", os.getenv("NEXT_FRONTEND_URL", "http://localhost:3000"))
     CORS_ORIGINS = [origin.strip() for origin in _cors_origins_str.split(",") if origin.strip()]
 
     # Google OAuth