diff --git a/poetry.lock b/poetry.lock
index a8856b6..8de8319 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -994,4 +994,4 @@ watchdog = ["watchdog (>=2.3)"]
 [metadata]
 lock-version = "2.0"
 python-versions = "^3.10"
-content-hash = "4ca6b31c654012f0d2b72bd44d3f40d986b183d6dd731c3a2aaed9a733032c08"
+content-hash = "7a7ba3831802cf91b722b956817a0606b7b8f97724b1a23e5e581657fb34ea19"
diff --git a/pyproject.toml b/pyproject.toml
index ee1ec1f..440e77d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -15,6 +15,7 @@ uvicorn = "^0.20.0"
 pandas = "^1.5.2"
 matplotlib = "^3.6.3"
 django-rest-framework = "^0.1.0"
+django-cors-headers = "^3.13.0"
 
 [tool.poetry.group.dev.dependencies]
 black = "^22.12.0"
diff --git a/timetracker/settings.py b/timetracker/settings.py
index c907d48..a668ce6 100644
--- a/timetracker/settings.py
+++ b/timetracker/settings.py
@@ -160,3 +160,18 @@ REST_FRAMEWORK = {
         "rest_framework.permissions.DjangoModelPermissionsOrAnonReadOnly"
     ]
 }
+
+FRONTEND_ROOT = os.path.abspath(os.path.join(BASE_DIR, "..", "frontend", "dist"))
+CORS_ORIGIN_ALLOW_ALL = True
+CORS_ALLOW_CREDENTIALS = True
+
+CORS_ALLOW_HEADERS = list(default_headers) + [
+    "Accept-Language",
+    "Connection",
+    "Host",
+    "Origin",
+    "Referer",
+    "Sec-Fetch-Dest",
+    "Sec-Fetch-Mode",
+    "Sec-Fetch-Site",
+]