diff --git a/Cargo.lock b/Cargo.lock
index a90282e..3e6e6dd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -62,6 +62,20 @@ dependencies = [
  "trust-dns-resolver",
 ]
 
+[[package]]
+name = "actix-cors"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36b133d8026a9f209a9aeeeacd028e7451bcca975f592881b305d37983f303d7"
+dependencies = [
+ "actix-web",
+ "derive_more",
+ "futures-util",
+ "log",
+ "once_cell",
+ "tinyvec",
+]
+
 [[package]]
 name = "actix-files"
 version = "0.5.0"
@@ -197,9 +211,9 @@ dependencies = [
 
 [[package]]
 name = "actix-rt"
-version = "2.5.0"
+version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05c2f80ce8d0c990941c7a7a931f69fd0701b76d521f8d36298edf59cd3fbf1f"
+checksum = "7ea16c295198e958ef31930a6ef37d0fb64e9ca3b6116e6b93a8bdae96ee1000"
 dependencies = [
  "actix-macros 0.2.3",
  "futures-core",
@@ -1412,9 +1426,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.117"
+version = "0.2.132"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e74d72e0f9b65b5b4ca49a346af3976df0f9c61d550727f349ecd559f251a26c"
+checksum = "8371e4e5341c3a96db127eb2465ac681ced4c433e01dd0e938adbef26ba93ba5"
 
 [[package]]
 name = "libsqlite3-sys"
@@ -1822,9 +1836,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.9.0"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da32515d9f6e6e489d7bc9d84c71b060db7247dc035bbe44eac88cf87486d8d5"
+checksum = "2f7254b99e31cad77da24b08ebf628882739a608578bb1bcdfc1f9c21260d7c0"
 
 [[package]]
 name = "opaque-debug"
@@ -2233,9 +2247,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.5.4"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -2253,9 +2267,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.6.25"
+version = "0.6.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
 
 [[package]]
 name = "remove_dir_all"
@@ -2853,9 +2867,9 @@ dependencies = [
 
 [[package]]
 name = "tracing"
-version = "0.1.29"
+version = "0.1.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "375a639232caf30edfc78e8d89b2d4c375515393e7af7e16f01cd96917fb2105"
+checksum = "a400e31aa60b9d44a52a8ee0343b5b18566b03a8321e0d321f695cf56e940160"
 dependencies = [
  "cfg-if 1.0.0",
  "log",
@@ -2877,11 +2891,11 @@ dependencies = [
 
 [[package]]
 name = "tracing-core"
-version = "0.1.26"
+version = "0.1.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f54c8ca710e81886d498c2fd3331b56c93aa248d49de2222ad2742247c60072f"
+checksum = "5aeea4303076558a00714b823f9ad67d58a3bbda1df83d8827d21193156e22f7"
 dependencies = [
- "lazy_static",
+ "once_cell",
  "valuable",
 ]
 
@@ -3058,9 +3072,10 @@ name = "upend"
 version = "0.0.63"
 dependencies = [
  "actix",
+ "actix-cors",
  "actix-files",
  "actix-multipart",
- "actix-rt 2.5.0",
+ "actix-rt 2.7.0",
  "actix-web",
  "actix_derive",
  "anyhow",
diff --git a/Cargo.toml b/Cargo.toml
index 987612c..53526b9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,6 +39,7 @@ actix-files = "^0.5"
 actix-rt = "^2.0"
 actix-web = "^3.3"
 actix_derive = "^0.5"
+actix-cors = "0.5"
 jsonwebtoken = "8"
 
 chrono = { version = "0.4", features = ["serde"] }
diff --git a/src/main.rs b/src/main.rs
index dfe91e7..987c704 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -8,6 +8,7 @@ extern crate lazy_static;
 use std::net::SocketAddr;
 use std::path::PathBuf;
 
+use actix_cors::Cors;
 use actix_web::{middleware, App, HttpServer};
 use anyhow::Result;
 use clap::{App as ClapApp, Arg};
@@ -209,7 +210,15 @@ fn main() -> Result<()> {
         let ui_path = ui_path.clone();
 
         let server = HttpServer::new(move || {
+            let cors = Cors::default()
+                .allowed_origin("http://localhost")
+                .allowed_origin_fn(|origin, _req_head| {
+                    origin.as_bytes().starts_with(b"http://localhost:")
+                })
+                .allow_any_method();
+
             let app = App::new()
+                .wrap(cors)
                 .app_data(actix_web::web::PayloadConfig::new(4_294_967_296))
                 .data(state.clone())
                 .wrap(middleware::Logger::default().exclude("/api/jobs"))