diff --git a/web/config/initializers/cors.rb b/web/config/initializers/cors.rb
index 884afbeda..568a7588e 100644
--- a/web/config/initializers/cors.rb
+++ b/web/config/initializers/cors.rb
@@ -2,7 +2,7 @@ Rails.application.config.middleware.insert_before 0, Rack::Cors do
   allow do
     origins Rails.configuration.spa_origin
 
-    resource '*',
+    resource '/api/*',
       headers: :any,
       methods: [:get, :post, :delete, :options],
       credentials: true