diff --git a/ara/server/settings.py b/ara/server/settings.py
index 58f88540..0f1102fa 100644
--- a/ara/server/settings.py
+++ b/ara/server/settings.py
@@ -28,6 +28,7 @@ INSTALLED_APPS = [
     'django.contrib.sessions',
     'django.contrib.messages',
     'django.contrib.staticfiles',
+    'corsheaders',
     'rest_framework',
     'ara.api'
 ]
@@ -35,6 +36,7 @@ INSTALLED_APPS = [
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
+    'corsheaders.middleware.CorsMiddleware',
     'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
@@ -44,6 +46,12 @@ MIDDLEWARE = [
 
 CORS_ORIGIN_ALLOW_ALL = True
 
+# Django built-in server and npm development server
+CORS_ORIGIN_WHITELIST = (
+    '127.0.0.1:8000',
+    'localhost:3000',
+)
+
 ROOT_URLCONF = 'ara.server.urls'
 APPEND_SLASH = False
 
diff --git a/requirements.txt b/requirements.txt
index cc0fde31..4d893098 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -2,4 +2,5 @@ pbr!=2.1.0,>=2.0.0 # Apache-2.0
 
 Django>=2
 djangorestframework
+django-cors-headers
 envparse