diff --git a/djinit/templates/project/settings/base.j2 b/djinit/templates/project/settings/base.j2
index d711d08..777cc36 100644
--- a/djinit/templates/project/settings/base.j2
+++ b/djinit/templates/project/settings/base.j2
@@ -149,13 +149,28 @@ SIMPLE_JWT = {
 }
 
 # CORS Settings
-CORS_ALLOWED_ORIGINS = [
-    "http://localhost:3000",
-    "http://127.0.0.1:3000",
+CORS_ALLOW_METHODS = [
+    "DELETE",
+    "GET",
+    "OPTIONS",
+    "PATCH",
+    "POST",
+    "PUT",
 ]
 
-CORS_ALLOW_CREDENTIALS = True
+CORS_ALLOW_HEADERS = [
+    "accept",
+    "accept-encoding",
+    "authorization",
+    "content-type",
+    "dnt",
+    "origin",
+    "user-agent",
+    "x-csrftoken",
+    "x-requested-with",
+]
 
+CORS_PREFLIGHT_MAX_AGE = 86400  # 24 hours
 # Security Settings
 SECURE_BROWSER_XSS_FILTER = True
 SECURE_CONTENT_TYPE_NOSNIFF = True
diff --git a/djinit/templates/project/settings/development.j2 b/djinit/templates/project/settings/development.j2
index 4761347..3de8340 100644
--- a/djinit/templates/project/settings/development.j2
+++ b/djinit/templates/project/settings/development.j2
@@ -23,7 +23,9 @@ DATABASES = {
 EMAIL_BACKEND = "django.core.mail.backends.console.EmailBackend"
 
 # CORS settings for development
+# Allow all origins in development (convenient but not secure)
 CORS_ALLOW_ALL_ORIGINS = True
+CORS_ALLOW_CREDENTIALS = True
 
 # Disable HTTPS redirect in development
 SECURE_SSL_REDIRECT = False
diff --git a/djinit/templates/project/settings/production.j2 b/djinit/templates/project/settings/production.j2
index 4f7d346..c76f19d 100644
--- a/djinit/templates/project/settings/production.j2
+++ b/djinit/templates/project/settings/production.j2
@@ -28,7 +28,16 @@ DATABASES = {
 }
 {% endif %}
 
+# CORS settings for production
+# Filter out empty strings from FRONTEND_URL
+frontend_urls = os.getenv("FRONTEND_URL", "")
+CORS_ALLOWED_ORIGINS = [
+    origin.strip() for origin in frontend_urls.split(",") if origin.strip()
+]
+CORS_ALLOW_CREDENTIALS = True
 
+# Additional CORS security for production
+CORS_ALLOW_PRIVATE_NETWORK = False
 
 # Email settings
 EMAIL_BACKEND = 'django.core.mail.backends.smtp.EmailBackend'
diff --git a/djinit/templates/shared/env_sample.j2 b/djinit/templates/shared/env_sample.j2
index 0a4e621..83b965c 100644
--- a/djinit/templates/shared/env_sample.j2
+++ b/djinit/templates/shared/env_sample.j2
@@ -15,6 +15,9 @@ DB_HOST=
 DB_PORT=
 {% endif %}
 
+# Frontend URL
+FRONTEND_URL=http://frontend.your-domain.com
+
 # Email settings
 EMAIL_HOST=
 EMAIL_PORT=