diff --git a/changelog/unreleased/frontend-cors.md b/changelog/unreleased/frontend-cors.md
new file mode 100644
index 000000000..025389d58
--- /dev/null
+++ b/changelog/unreleased/frontend-cors.md
@@ -0,0 +1,6 @@
+Bugfix: fix CORS in frontend service
+
+We now pass CORS config to the frontend reva service middleware.
+
+https://github.com/owncloud/ocis/pull/4948
+https://github.com/owncloud/ocis/issues/1340
\ No newline at end of file
diff --git a/services/frontend/pkg/config/config.go b/services/frontend/pkg/config/config.go
index de4837c24..b293e757f 100644
--- a/services/frontend/pkg/config/config.go
+++ b/services/frontend/pkg/config/config.go
@@ -79,6 +79,15 @@ type HTTPConfig struct {
 	Namespace string `yaml:"-"`
 	Protocol  string `yaml:"protocol" env:"FRONTEND_HTTP_PROTOCOL" desc:"The transport protocol of the HTTP service."`
 	Prefix    string `yaml:"prefix" env:"FRONTEND_HTTP_PREFIX" desc:"The Path prefix where the frontend can be accessed (defaults to /)."`
+	CORS      CORS   `yaml:"cors"`
+}
+
+// CORS defines the available cors configuration.
+type CORS struct {
+	AllowedOrigins   []string `yaml:"allow_origins" env:"OCIS_CORS_ALLOW_ORIGINS;FRONTEND_CORS_ALLOW_ORIGINS" desc:"A comma-separated list of allowed CORS origins. See following chapter for more details: *Access-Control-Allow-Origin* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin"`
+	AllowedMethods   []string `yaml:"allow_methods" env:"OCIS_CORS_ALLOW_METHODS;FRONTEND_CORS_ALLOW_METHODS" desc:"A comma-separated list of allowed CORS methods. See following chapter for more details: *Access-Control-Request-Method* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method"`
+	AllowedHeaders   []string `yaml:"allow_headers" env:"OCIS_CORS_ALLOW_HEADERS;FRONTEND_CORS_ALLOW_HEADERS" desc:"A comma-separated list of allowed CORS headers. See following chapter for more details: *Access-Control-Request-Headers* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers."`
+	AllowCredentials bool     `yaml:"allow_credentials" env:"OCIS_CORS_ALLOW_CREDENTIALS;FRONTEND_CORS_ALLOW_CREDENTIALS" desc:"Allow credentials for CORS.See following chapter for more details: *Access-Control-Allow-Credentials* at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials."`
 }
 
 // Middleware configures reva middlewares.
diff --git a/services/frontend/pkg/config/defaults/defaultconfig.go b/services/frontend/pkg/config/defaults/defaultconfig.go
index 49b8a58dc..53d8f4e79 100644
--- a/services/frontend/pkg/config/defaults/defaultconfig.go
+++ b/services/frontend/pkg/config/defaults/defaultconfig.go
@@ -25,6 +25,49 @@ func DefaultConfig() *config.Config {
 			Namespace: "com.owncloud.web",
 			Protocol:  "tcp",
 			Prefix:    "",
+			CORS: config.CORS{
+				AllowedOrigins: []string{"*"},
+				AllowedMethods: []string{
+					"OPTIONS",
+					"HEAD",
+					"GET",
+					"PUT",
+					"POST",
+					"DELETE",
+					"MKCOL",
+					"PROPFIND",
+					"PROPPATCH",
+					"MOVE",
+					"COPY",
+					"REPORT",
+					"SEARCH",
+				},
+				AllowedHeaders: []string{
+					"Origin",
+					"Accept",
+					"Content-Type",
+					"Depth",
+					"Authorization",
+					"Ocs-Apirequest",
+					"If-None-Match",
+					"If-Match",
+					"Destination",
+					"Overwrite",
+					"X-Request-Id",
+					"X-Requested-With",
+					"Tus-Resumable",
+					"Tus-Checksum-Algorithm",
+					"Upload-Concat",
+					"Upload-Length",
+					"Upload-Metadata",
+					"Upload-Defer-Length",
+					"Upload-Expires",
+					"Upload-Checksum",
+					"Upload-Offset",
+					"X-HTTP-Method-Override",
+				},
+				AllowCredentials: true,
+			},
 		},
 		Service: config.Service{
 			Name: "frontend",
diff --git a/services/frontend/pkg/revaconfig/config.go b/services/frontend/pkg/revaconfig/config.go
index 32f66ae43..28b928dfe 100644
--- a/services/frontend/pkg/revaconfig/config.go
+++ b/services/frontend/pkg/revaconfig/config.go
@@ -80,7 +80,16 @@ func FrontendConfigFromStruct(cfg *config.Config) (map[string]interface{}, error
 			"address": cfg.HTTP.Addr,
 			"middlewares": map[string]interface{}{
 				"cors": map[string]interface{}{
-					"allow_credentials": true,
+					"allowed_origins":   cfg.HTTP.CORS.AllowedOrigins,
+					"allowed_methods":   cfg.HTTP.CORS.AllowedMethods,
+					"allowed_headers":   cfg.HTTP.CORS.AllowedHeaders,
+					"allow_credentials": cfg.HTTP.CORS.AllowCredentials,
+					// currently unused
+					//"options_passthrough": ,
+					//"debug": ,
+					//"max_age": ,
+					//"priority": ,
+					//"exposed_headers": ,
 				},
 				"auth": map[string]interface{}{
 					"credentials_by_user_agent": cfg.Middleware.Auth.CredentialsByUserAgent,