diff --git a/go.sum b/go.sum
index c75866182..ccd512945 100644
--- a/go.sum
+++ b/go.sum
@@ -132,10 +132,6 @@ github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/lithammer/shortuuid/v3 v3.0.6 h1:pr15YQyvhiSX/qPxncFtqk+v4xLEpOZObbsY/mKrcvA=
 github.com/lithammer/shortuuid/v3 v3.0.6/go.mod h1:vMk8ke37EmiewwolSO1NLW8vP4ZaKlRuDIi8tWWmAts=
-github.com/livekit/protocol v0.11.11-0.20220113073321-71562c1a1a33 h1:XlV/QWVrwkCXXq/sS9ADNsIUGQWTJRaXSeCLznzc9OQ=
-github.com/livekit/protocol v0.11.11-0.20220113073321-71562c1a1a33/go.mod h1:YoHW9YbWbPnuVsgwBB4hAINKT+V68jmfh9zXBSSn6Wg=
-github.com/livekit/protocol v0.11.11-0.20220113220524-70bf63940230 h1:MFXlr2tTopDdzH8SxiEMHrVqo2hOp97n21QxKyDDkbw=
-github.com/livekit/protocol v0.11.11-0.20220113220524-70bf63940230/go.mod h1:YoHW9YbWbPnuVsgwBB4hAINKT+V68jmfh9zXBSSn6Wg=
 github.com/livekit/protocol v0.11.11-0.20220113222200-a4208afda1fd h1:62EgUkw1tQyqgie8o03/56f6ZSW5i6o3bApYPYFCK5c=
 github.com/livekit/protocol v0.11.11-0.20220113222200-a4208afda1fd/go.mod h1:YoHW9YbWbPnuVsgwBB4hAINKT+V68jmfh9zXBSSn6Wg=
 github.com/magefile/mage v1.11.0 h1:C/55Ywp9BpgVVclD3lRnSYCwXTYxmSppIgLeDYlNuls=
diff --git a/pkg/service/server.go b/pkg/service/server.go
index 93dfe8d87..1a93e8f27 100644
--- a/pkg/service/server.go
+++ b/pkg/service/server.go
@@ -66,7 +66,10 @@ func NewLivekitServer(conf *config.Config,
 		negroni.NewRecovery(),
 		// CORS is allowed, we rely on token authentication to prevent improper use
 		cors.New(cors.Options{
-			AllowedOrigins: []string{"*"},
+			AllowOriginFunc: func(origin string) bool {
+				return true
+			},
+			AllowedHeaders: []string{"*"},
 		}),
 	}
 	if keyProvider != nil {
diff --git a/test/singlenode_test.go b/test/singlenode_test.go
index d3ce432ca..431ce4e39 100644
--- a/test/singlenode_test.go
+++ b/test/singlenode_test.go
@@ -316,10 +316,11 @@ func TestSingleNodeCORS(t *testing.T) {
 	s, finish := setupSingleNodeTest("TestSingleNodeCORS", testRoom)
 	defer finish()
 
-	req, err := http.NewRequest("GET", fmt.Sprintf("http://localhost:%d", s.HTTPPort()), nil)
+	req, err := http.NewRequest("POST", fmt.Sprintf("http://localhost:%d", s.HTTPPort()), nil)
 	require.NoError(t, err)
+	req.Header.Set("Authorization", "bearer xyz")
 	req.Header.Set("Origin", "testhost.com")
 	res, err := http.DefaultClient.Do(req)
 	require.NoError(t, err)
-	require.Equal(t, "*", res.Header.Get("Access-Control-Allow-Origin"))
+	require.Equal(t, "testhost.com", res.Header.Get("Access-Control-Allow-Origin"))
 }