diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index 4f8f6bc..758d7b5 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -114,6 +114,7 @@ version = "0.1.0"
 dependencies = [
  "futures-util",
  "rocket",
+ "rocket_cors",
  "rocket_db_pools",
  "serde",
  "tokio",
@@ -1247,6 +1248,18 @@ dependencies = [
  "syn 2.0.106",
 ]
 
+[[package]]
+name = "regex"
+version = "1.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b5288124840bee7b386bc413c487869b360b2b4ec421ea56425128692f2a82c"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
 [[package]]
 name = "regex-automata"
 version = "0.4.11"
@@ -1333,6 +1346,23 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "rocket_cors"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfac3a1df83f8d4fc96aa41dba3b86c786417b7fc0f52ec76295df2ba781aa69"
+dependencies = [
+ "http 0.2.12",
+ "log",
+ "regex",
+ "rocket",
+ "serde",
+ "serde_derive",
+ "unicase",
+ "unicase_serde",
+ "url",
+]
+
 [[package]]
 name = "rocket_db_pools"
 version = "0.2.0"
@@ -2050,6 +2080,22 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "unicase"
+version = "2.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
+
+[[package]]
+name = "unicase_serde"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ef53697679d874d69f3160af80bc28de12730a985d57bdf2b47456ccb8b11f1"
+dependencies = [
+ "serde",
+ "unicase",
+]
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.19"
@@ -2089,6 +2135,7 @@ dependencies = [
  "form_urlencoded",
  "idna",
  "percent-encoding",
+ "serde",
 ]
 
 [[package]]
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index 85fcfed..695d856 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -6,6 +6,7 @@ edition = "2024"
 [dependencies]
 futures-util = "0.3.31"
 rocket = { version = "0.5.1", features = ["json"] }
+rocket_cors = "0.6.0"
 rocket_db_pools = { version = "0.2.0", features = ["sqlx_sqlite"] }
 serde = { version = "1.0.228", features = ["derive"] }
 tokio = { version = "1.47.1", features = ["full"] }
diff --git a/backend/src/main.rs b/backend/src/main.rs
index b3f5afc..0e47146 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -2,9 +2,11 @@
 #[macro_use]
 extern crate rocket;
 
+use rocket::http::Method;
 use rocket::response::stream::{Event, EventStream};
 use rocket::serde::json::Json;
 use rocket::{Build, Rocket};
+use rocket_cors::{AllowedOrigins, CorsOptions};
 use serde::Deserialize;
 use std::sync::Arc;
 use tokio::sync::broadcast;
@@ -67,7 +69,18 @@ async fn event_stream(chat: &rocket::State<Arc<ChatBroadcaster>>) -> EventStream
 fn rocket() -> Rocket<Build> {
     let chat = Arc::new(ChatBroadcaster::new(32));
 
+    let cors = CorsOptions::default()
+        .allowed_origins(AllowedOrigins::all())
+        .allowed_methods(
+            vec![Method::Get, Method::Post, Method::Patch]
+                .into_iter()
+                .map(From::from)
+                .collect(),
+        )
+        .allow_credentials(true);
+
     rocket::build()
         .manage(chat)
+        .attach(cors.to_cors().unwrap())
         .mount("/", routes![post_message, event_stream])
 }