diff --git a/src/main.rs b/src/main.rs
index 84432345c0..276b38eddb 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -91,8 +91,11 @@ pub async fn serve(server_state: ServerState) -> AnyhowResult<()>
     App::new()
       .app_data(server_state_arc.clone())
       .wrap(Cors::default()
+        .allowed_origin("http://api.jungle.horse")
         .allowed_origin("http://api.vo.codes")
         .allowed_origin("http://jungle.horse")
+        .allowed_origin("http://jungle.horse:12345")
+        .allowed_origin("http://jungle.horse:7000")
         .allowed_origin("http://localhost:12345")
         .allowed_origin("http://localhost:3000")
         .allowed_origin("http://localhost:5555")
@@ -104,15 +107,18 @@ pub async fn serve(server_state: ServerState) -> AnyhowResult<()>
         .allowed_origin("http://vo.codes")
         .allowed_origin("http://vocodes.com")
         .allowed_origin("https://jungle.horse")
+        .allowed_origin("https://api.jungle.horse")
         .allowed_origin("https://mumble.stream")
         .allowed_origin("https://trumped.com")
         .allowed_origin("https://vo.codes")
         .allowed_origin("https://vocodes.com")
         .allowed_methods(vec!["GET", "POST", "OPTIONS"])
+        .supports_credentials()
         .allowed_headers(vec![
           http::header::ACCEPT,
           http::header::ACCESS_CONTROL_ALLOW_ORIGIN, // Tabulator Ajax
           http::header::CONTENT_TYPE,
+          http::header::ACCESS_CONTROL_ALLOW_CREDENTIALS, // https://stackoverflow.com/a/46412839
           http::header::HeaderName::from_static("x-requested-with") // Tabulator Ajax sends
         ])
         .max_age(3600))
diff --git a/src/util/cookies.rs b/src/util/cookies.rs
index adc0c14bc7..966c7b895b 100644
--- a/src/util/cookies.rs
+++ b/src/util/cookies.rs
@@ -1,4 +1,4 @@
-use actix_web::cookie::Cookie;
+use actix_web::cookie::{Cookie, SameSite};
 use actix_web::{HttpRequest, HttpMessage};
 use anyhow::anyhow;
 use crate::AnyhowResult;
@@ -11,6 +11,7 @@ use sha2::Sha256;
 use std::collections::BTreeMap;
 use std::ops::Sub;
 use time::OffsetDateTime;
+use log::LevelFilter::Off;
 
 const COOKIE_VERSION : u32 = 1;
 
@@ -42,11 +43,17 @@ impl CookieManager {
 
     let jwt_string = claims.sign_with_key(&key)?;
 
+    let make_secure = !self.cookie_domain.to_lowercase().contains("jungle.horse")
+      && !self.cookie_domain.to_lowercase().contains("localhost");
+
     Ok(Cookie::build(SESSION_COOKIE_NAME, jwt_string)
-      .domain(&self.cookie_domain)
-      .path("/")
-      .secure(true) // HTTPS-only
-      .http_only(true) // Not exposed to Javascript
+      //.domain(&self.cookie_domain)
+      .secure(make_secure) // HTTPS-only
+      //.path("/")
+      //.http_only(true) // Not exposed to Javascript
+      //.expires(OffsetDateTime::now_utc() + time::Duration::days(365))
+      .permanent()
+      //.same_site(SameSite::Lax)
       .finish())
   }