diff --git a/src/main/java/com/guo/learningprogresstracker/config/CorsProperties.java b/src/main/java/com/guo/learningprogresstracker/config/CorsProperties.java
index f2731f2..91dacad 100644
--- a/src/main/java/com/guo/learningprogresstracker/config/CorsProperties.java
+++ b/src/main/java/com/guo/learningprogresstracker/config/CorsProperties.java
@@ -9,5 +9,6 @@ import org.springframework.context.annotation.Configuration;
 @ConfigurationProperties(prefix = "cors")
 public class CorsProperties {
     private String[] allowedOrigins;
+    private Boolean allowCredentials;
 
 }
diff --git a/src/main/java/com/guo/learningprogresstracker/config/WebCorsConfig.java b/src/main/java/com/guo/learningprogresstracker/config/WebCorsConfig.java
index 5fbd691..fbd16e3 100644
--- a/src/main/java/com/guo/learningprogresstracker/config/WebCorsConfig.java
+++ b/src/main/java/com/guo/learningprogresstracker/config/WebCorsConfig.java
@@ -24,6 +24,6 @@ public class WebCorsConfig implements WebMvcConfigurer {
                 .allowedOrigins(corsProperties.getAllowedOrigins())
                 .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
                 .allowedHeaders("*")
-                .allowCredentials(true);
+                .allowCredentials(null == corsProperties.getAllowCredentials() || corsProperties.getAllowCredentials());
     }
 }
diff --git a/src/main/resources/application-dev.yml b/src/main/resources/application-dev.yml
index 35def61..7d8c2dc 100644
--- a/src/main/resources/application-dev.yml
+++ b/src/main/resources/application-dev.yml
@@ -9,6 +9,7 @@ server:
     port: 5155
 
 cors:
+    allowCredentials: false
     allowed-origins:
     - '*'