diff --git a/config.ini b/config.ini
index f0639f2c6..dae4bce0e 100644
--- a/config.ini
+++ b/config.ini
@@ -7,3 +7,4 @@ v = true  # show debug logging
 appName = CreateBridge
 updateUrl = http://downloads.arduino.cc/
 #updateUrl = http://localhost/
+origins = http://webide.arduino.cc:8080
\ No newline at end of file
diff --git a/main.go b/main.go
index 87a644dbd..c92bfe525 100755
--- a/main.go
+++ b/main.go
@@ -43,6 +43,7 @@ var (
 	tempToolsPath  = createToolsDir()
 	port           string
 	portSSL        string
+	origins        = flag.String("origins", "", "Allowed origin list for CORS")
 )
 
 type NullWriter int
@@ -109,6 +110,20 @@ func main() {
 				iniflags.Parse()
 			}
 
+			// move CORS to config file compatibility, Vagrant version
+			if *origins == "" {
+				log.Println("Patching config.ini for compatibility")
+				f, err := os.OpenFile(dest+"/"+*configIni, os.O_APPEND|os.O_WRONLY, 0666)
+				if err != nil {
+					panic(err)
+				}
+				_, err = f.WriteString("\norigins = http://webide.arduino.cc:8080\n")
+				if err != nil {
+					panic(err)
+				}
+				f.Close()
+				restart("")
+			}
 			//log.SetFormatter(&log.JSONFormatter{})
 
 			log.SetLevel(log.InfoLevel)
@@ -194,8 +209,14 @@ func main() {
 
 			socketHandler := wsHandler().ServeHTTP
 
+			extraOriginStr := "https://create.arduino.cc, http://create.arduino.cc, https://create-dev.arduino.cc, http://create-dev.arduino.cc, http://create-staging.arduino.cc, https://create-staging.arduino.cc,"
+
+			for i := 8990; i < 9001; i++ {
+				extraOriginStr = extraOriginStr + " http://localhost:" + strconv.Itoa(i) + ", https://localhost:" + strconv.Itoa(i)
+			}
+
 			r.Use(cors.Middleware(cors.Config{
-				Origins:         "https://create.arduino.cc, http://create.arduino.cc, https://create-dev.arduino.cc, http://create-dev.arduino.cc, http://webide.arduino.cc:8080, http://create-staging.arduino.cc, https://create-staging.arduino.cc, http://localhost:8989, https://localhost:8990",
+				Origins:         *origins + "," + extraOriginStr,
 				Methods:         "GET, PUT, POST, DELETE",
 				RequestHeaders:  "Origin, Authorization, Content-Type",
 				ExposedHeaders:  "",