diff --git a/config/application.rb b/config/application.rb
index 9589ee9b..70936238 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -40,9 +40,10 @@ module Gitlink
 
     config.middleware.insert_before 0, Rack::Cors do
       allow do
-        origins '*'
+        # origins '*'
+        origins /http:\/\/localhost(:\d+)?\z/,  /^(http|https):\/\/(.*(gitlink.org.cn))$/
         # location of your api
-        resource '/*', :headers => :any, :methods => [:get, :post, :delete, :options, :put, :patch]
+        resource '/*', :headers => :any, :methods => [:get, :post, :delete, :options, :put], credentials: true
       end
     end
   end