diff --git a/router/routes/routes.go b/router/routes/routes.go
index 364789d..f5b7abc 100644
--- a/router/routes/routes.go
+++ b/router/routes/routes.go
@@ -38,7 +38,11 @@ func NewServ() *gin.Engine {
 	// enable cors
 	corsConfig := cors.DefaultConfig()
 	corsConfig.AllowCredentials = true
-	corsConfig.AllowAllOrigins = true
+	corsConfig.AllowOrigins = []string{
+		"http://localhost:8080",
+		"http://localhost:8081",
+		"https://bot.trj.tw",
+	}
 	r.Use(cors.New(corsConfig))
 	// session
 	r.Use(sessions.Sessions("ginsess", store))