diff --git a/Cargo.lock b/Cargo.lock
index 4c7bef1..54cfd20 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -19,6 +19,21 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "actix-cors"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9e772b3bcafe335042b5db010ab7c09013dad6eac4915c91d8d50902769f331"
+dependencies = [
+ "actix-utils",
+ "actix-web",
+ "derive_more",
+ "futures-util",
+ "log",
+ "once_cell",
+ "smallvec",
+]
+
 [[package]]
 name = "actix-http"
 version = "3.3.1"
@@ -2085,6 +2100,7 @@ dependencies = [
 name = "tfcapi"
 version = "0.1.0"
 dependencies = [
+ "actix-cors",
  "actix-multipart",
  "actix-rt",
  "actix-web",
diff --git a/Cargo.toml b/Cargo.toml
index ed3bd99..df070a0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,3 +23,4 @@ lettre = { version = "0.11.3", features = ["smtp-transport"] }
 markup = "0.15.0"
 maud = { version = "0.26.0", features = ["actix-web"] }
 log4rs = "1.3.0"
+actix-cors = "0.7.0"
diff --git a/flake.lock b/flake.lock
index 20fb2bc..5a97c90 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "cl-nix-lite": {
       "locked": {
-        "lastModified": 1709357207,
-        "narHash": "sha256-YZgXj6oL2Y/zDkSkGcoacpQPRLiYM8KeEB68CUs2irc=",
+        "lastModified": 1720140845,
+        "narHash": "sha256-PHCrp44fIM8RGfXsh413Vo2Cf9CnEqiEuktYv57GkLA=",
         "owner": "hraban",
         "repo": "cl-nix-lite",
-        "rev": "f55d263b30a601b1b4dd61b7c8787e97510f4018",
+        "rev": "9a9a63a211c7a03eee62fe3dcd3983b8d4ddd5a6",
         "type": "github"
       },
       "original": {
@@ -20,11 +20,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
         "type": "github"
       },
       "original": {
@@ -35,11 +35,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1704194953,
-        "narHash": "sha256-RtDKd8Mynhe5CFnVT8s0/0yqtWFMM9LmCzXv/YKxnq4=",
+        "lastModified": 1720031269,
+        "narHash": "sha256-rwz8NJZV+387rnWpTYcXaRNvzUSnnF9aHONoJIYmiUQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "bd645e8668ec6612439a9ee7e71f7eac4099d4f6",
+        "rev": "9f4128e00b0ae8ec65918efeba59db998750ead6",
         "type": "github"
       },
       "original": {
diff --git a/src/main.rs b/src/main.rs
index 075f3d7..e467e7a 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,5 +1,6 @@
 mod api;
 
+use actix_cors::Cors;
 use actix_multipart::form::tempfile::TempFileConfig;
 use actix_web::{middleware, App, HttpServer};
 use api::camp_form::camp_form;
@@ -48,8 +49,11 @@ async fn main() -> std::io::Result<()> {
     log::info!("starting HTTP server at http://localhost:4242");
 
     HttpServer::new(|| {
+        let cors = Cors::permissive();
+
         App::new()
             .wrap(middleware::Logger::default())
+            .wrap(cors)
             .app_data(TempFileConfig::default().directory("./tmp"))
             .service(mt_form)
             .service(health_form)