diff --git a/src/api/middlewares/Authentication.ts b/src/api/middlewares/Authentication.ts
index 5d239a17e..2dd992ee3 100644
--- a/src/api/middlewares/Authentication.ts
+++ b/src/api/middlewares/Authentication.ts
@@ -85,7 +85,7 @@ export async function Authentication(req: Request, res: Response, next: NextFunc
 			.find((x) => x.startsWith("__sb_sessid="))!
 			.split("=")[1];
 	// for some reason we need to require here, else the openapi generator fails with "route is not a function"
-	else res.setHeader("Set-Cookie", `__sb_sessid=${req.fingerprint = (await require("../util")).randomString(32)}; Secure; HttpOnly; SameSite=None`);
+	else res.setHeader("Set-Cookie", `__sb_sessid=${req.fingerprint = (await require("../util")).randomString(32)}; Secure; HttpOnly; SameSite=None; Path=/`);
 
 	if (
 		NO_AUTHORIZATION_ROUTES.some((x) => {
diff --git a/src/api/middlewares/CORS.ts b/src/api/middlewares/CORS.ts
index ca6abb82d..84c49a8bd 100644
--- a/src/api/middlewares/CORS.ts
+++ b/src/api/middlewares/CORS.ts
@@ -21,20 +21,16 @@ import { NextFunction, Request, Response } from "express";
 // TODO: config settings
 
 export function CORS(req: Request, res: Response, next: NextFunction) {
-	res.set("Access-Control-Allow-Origin", "*");
+	res.set("Access-Control-Allow-Credentials", "true");
+	res.set("Access-Control-Allow-Headers", req.header("Access-Control-Request-Headers") || "*");
+	res.set("Access-Control-Allow-Methods", req.header("Access-Control-Request-Methods") || "*");
+	res.set("Access-Control-Allow-Origin", req.header("Origin") ?? "*");
+	res.set("Access-Control-Max-Age", "5"); // dont make it too long so we can change it dynamically
 	// TODO: use better CSP
 	res.set(
 		"Content-security-policy",
 		"default-src *  data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval'; script-src * data: blob: 'unsafe-inline' 'unsafe-eval'; connect-src * data: blob: 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src * data: blob: ; style-src * data: blob: 'unsafe-inline'; font-src * data: blob: 'unsafe-inline';",
 	);
-	res.set(
-		"Access-Control-Allow-Headers",
-		req.header("Access-Control-Request-Headers") || "*",
-	);
-	res.set(
-		"Access-Control-Allow-Methods",
-		req.header("Access-Control-Request-Methods") || "*",
-	);
 
 	if (req.method === "OPTIONS") {
 		res.status(204).end();
diff --git a/src/gateway/Server.ts b/src/gateway/Server.ts
index 5d7f8d87a..2ad3e4136 100644
--- a/src/gateway/Server.ts
+++ b/src/gateway/Server.ts
@@ -52,7 +52,7 @@ export class Server {
 		else {
 			this.server = http.createServer(function (req, res) {
 				if(!req.headers.cookie?.split("; ").find(x => x.startsWith("__sb_sessid="))) {
-					res.setHeader("Set-Cookie", `__sb_sessid=${randomString(32)}; Secure; HttpOnly; SameSite=None`);
+					res.setHeader("Set-Cookie", `__sb_sessid=${randomString(32)}; Secure; HttpOnly; SameSite=None; Path=/`);
 				}
 
 				res.writeHead(200).end("Online");