diff --git a/src/main/java/in/koreatech/payment/common/config/CorsProperties.java b/src/main/java/in/koreatech/payment/common/config/CorsProperties.java
new file mode 100644
index 0000000..99371de
--- /dev/null
+++ b/src/main/java/in/koreatech/payment/common/config/CorsProperties.java
@@ -0,0 +1,12 @@
+package in.koreatech.payment.common.config;
+
+import java.util.List;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+
+@ConfigurationProperties(prefix = "cors")
+public record CorsProperties(
+    List<String> allowedOrigins
+) {
+
+}
diff --git a/src/main/java/in/koreatech/payment/common/config/WebConfig.java b/src/main/java/in/koreatech/payment/common/config/WebConfig.java
index 722614a..9924888 100644
--- a/src/main/java/in/koreatech/payment/common/config/WebConfig.java
+++ b/src/main/java/in/koreatech/payment/common/config/WebConfig.java
@@ -4,6 +4,7 @@
 
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
@@ -19,6 +20,8 @@ public class WebConfig implements WebMvcConfigurer {
 
     private final AccessTokenArgumentResolver accessTokenArgumentResolver;
 
+    private final CorsProperties corsProperties;
+
     @Override
     public void addInterceptors(InterceptorRegistry registry) {
         registry.addInterceptor(extractAccessTokenInterceptor)
@@ -30,4 +33,14 @@ public void addInterceptors(InterceptorRegistry registry) {
     public void addArgumentResolvers(List<HandlerMethodArgumentResolver> resolvers) {
         resolvers.add(accessTokenArgumentResolver);
     }
+
+    @Override
+    public void addCorsMappings(CorsRegistry registry) {
+        registry.addMapping("/**")
+            .allowedOrigins(corsProperties.allowedOrigins().toArray(new String[0]))
+            .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH")
+            .allowedHeaders("*")
+            .allowCredentials(true)
+            .maxAge(3600);
+    }
 }