diff --git a/backend/main.py b/backend/main.py
index 2f3a0df..34f4f39 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -36,6 +36,16 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+@app.middleware("http")
+async def add_cors_header(request: Request, call_next):
+    response = await call_next(request)
+    origin = request.headers.get("origin", "")
+    if origin and "access-control-allow-origin" not in response.headers:
+        response.headers["access-control-allow-origin"] = "*"
+        response.headers["access-control-allow-methods"] = "GET, POST, PUT, DELETE, OPTIONS"
+        response.headers["access-control-allow-headers"] = "*"
+    return response
+
 db_service = DatabaseService()
 
 METRICS_FILE = os.path.join(os.path.dirname(__file__), 'metrics.txt')