diff --git a/apps/api/main.py b/apps/api/main.py
index 865c89184..5507d2a1f 100644
--- a/apps/api/main.py
+++ b/apps/api/main.py
@@ -30,12 +30,24 @@ app.add_exception_handler(StarletteHTTPException, http_exception_handler)
 app.add_exception_handler(RequestValidationError, validation_exception_handler)
 app.add_exception_handler(Exception, general_exception_handler)
 
+# P1-1: Fix CORS configuration security issue
+# - allow_credentials=True is incompatible with allow_origins=["*"]
+# - In production, only allow configured domains, not "*"
+if settings.DEBUG:
+    allow_origins = settings.CORS_ORIGINS  # Allow localhost in debug mode
+else:
+    # In production, filter out any wildcard "*" origins
+    allow_origins = [origin for origin in settings.CORS_ORIGINS if origin != "*"]
+    if not allow_origins:
+        # Default to production domain if no valid origins configured
+        allow_origins = ["https://xiaoxiajianji.com"]
+
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=settings.CORS_ORIGINS,
+    allow_origins=allow_origins,
     allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
+    allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS"],
+    allow_headers=["Authorization", "Content-Type"],
 )
 app.add_middleware(GZipMiddleware, minimum_size=1000)
 app.add_middleware(RequestLoggingMiddleware)