diff --git a/app/Http/Middleware/CollectCors.php b/app/Http/Middleware/CollectCors.php
index 316f563..06d3262 100644
--- a/app/Http/Middleware/CollectCors.php
+++ b/app/Http/Middleware/CollectCors.php
@@ -25,15 +25,27 @@ class CollectCors
 
     private function corsHeaders(Request $request): array
     {
-        // Get the origin from the request, default to '*' if not present
-        $origin = $request->header('Origin', '*');
+        // Get the origin from the request
+        $origin = $request->header('Origin');
+
+        // If origin is present, allow it with credentials
+        // Otherwise, use wildcard without credentials
+        if ($origin) {
+            return [
+                'Access-Control-Allow-Origin' => $origin,
+                'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS',
+                'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With',
+                'Access-Control-Max-Age' => '86400',
+                'Access-Control-Allow-Credentials' => 'true',
+                'Vary' => 'Origin',
+            ];
+        }
 
         return [
-            'Access-Control-Allow-Origin' => $origin,
+            'Access-Control-Allow-Origin' => '*',
             'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS',
             'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With',
             'Access-Control-Max-Age' => '86400',
-            'Access-Control-Allow-Credentials' => 'true',
         ];
     }
 }