diff --git a/config/envoy.yaml b/config/envoy.yaml
index 5a67509..c4508fe 100644
--- a/config/envoy.yaml
+++ b/config/envoy.yaml
@@ -20,6 +20,9 @@ static_resources:
                 stat_prefix: ingress_http
                 codec_type: auto
                 http_filters:
+                  - name: envoy.filters.http.cors
+                    typed_config:
+                      "@type": type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
                   - name: envoy.filters.http.router
                     typed_config:
                       "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
@@ -43,8 +46,9 @@ static_resources:
                           "@type": type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy
                           allow_origin_string_match:
                             - prefix: "*"
-                          allow_methods: GET, PUT, DELETE, POST, OPTIONS
-                          allow_headers: Accept, Accept-Language, Content-Language, Content-Type, Range
+                          allow_methods: "GET, POST, PUT, PATCH, DELETE, OPTIONS"
+                          allow_headers: "DNT, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type, Range, Authorization, Priority, Access-Control-Allow-Origin"
+                          allow_credentials: true
                           max_age: "1728000"
   clusters:
     - name: stacks_api