diff --git a/.vscode/settings.json b/.vscode/settings.json
index bb56588..3d84689 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -3,6 +3,7 @@
     "buildx",
     "dbdocs",
     "dbml",
+    "gistory",
     "gitops",
     "gsainfoteam",
     "infoteam",
diff --git a/src/main.ts b/src/main.ts
index 593b8c8..01a5a67 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -5,6 +5,25 @@ import { ConfigService } from '@nestjs/config';
 
 async function bootstrap() {
   const app = await NestFactory.create(AppModule);
+  // set CORS config
+  const whitelist = [
+    /https:\/\/.*groups.gistory.me/,
+    /https:\/\/.*groups-fe.pages.dev/,
+    /http:\/\/localhost:3000/,
+  ];
+  app.enableCors({
+    origin: function (origin, callback) {
+      if (!origin || whitelist.some((regex) => regex.test(origin))) {
+        callback(null, origin);
+      } else {
+        callback(new Error('Not allowed by CORS'));
+      }
+    },
+    methods: 'GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS',
+    preflightContinue: false,
+    optionsSuccessStatus: 204,
+    credentials: true,
+  });
   // load config service
   const configService = app.get(ConfigService);
   // swagger config