diff --git a/services/Directory/FilterLists.Directory.Api/CorsConfiguration.cs b/services/Directory/FilterLists.Directory.Api/CorsConfiguration.cs
index 232cf9b9a..14f2242f9 100644
--- a/services/Directory/FilterLists.Directory.Api/CorsConfiguration.cs
+++ b/services/Directory/FilterLists.Directory.Api/CorsConfiguration.cs
@@ -4,11 +4,18 @@ namespace FilterLists.Directory.Api;
 
 internal static class CorsConfiguration
 {
-    internal static readonly Action<CorsOptions> SetupAction = options =>
-        options.AddDefaultPolicy(policy =>
-            policy
-                .AllowAnyOrigin()
-                .WithMethods("GET")
-                .AllowAnyHeader()
-        );
+    private const string ProductionClientOrigin = "https://filterlists.com";
+    private const string StagingClientOriginStart = "https://nice-water-05873140f";
+    private const string StagingClientOriginEnd = ".eastus2.5.azurestaticapps.net";
+    private const string LocalClientOrigin = "http://localhost:3000";
+
+    internal static readonly Action<CorsOptions> SetupAction = options => options.AddDefaultPolicy(policy =>
+    {
+        policy.SetIsOriginAllowed(origin =>
+                origin is ProductionClientOrigin or LocalClientOrigin ||
+                (origin.StartsWith(StagingClientOriginStart, StringComparison.InvariantCulture) &&
+                 origin.EndsWith(StagingClientOriginEnd, StringComparison.InvariantCulture)))
+            .WithMethods("GET")
+            .AllowAnyHeader();
+    });
 }
\ No newline at end of file