diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java
index 1cc5893df..a3a296a94 100644
--- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java
+++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java
@@ -2,6 +2,7 @@ package ru.spcex.clearing.backendapi.config;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.boot.web.server.Cookie;
 import org.springframework.boot.web.server.WebServerFactoryCustomizer;
 import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
 import org.springframework.boot.web.servlet.server.CookieSameSiteSupplier;
@@ -13,6 +14,7 @@ import org.springframework.http.converter.json.MappingJackson2HttpMessageConvert
 import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.context.request.RequestContextListener;
 import org.springframework.web.servlet.config.annotation.*;
+import ru.spcex.clearing.backendapi.config.element.BackendApiSettings;
 
 import java.util.List;
 import java.util.function.Consumer;
@@ -24,10 +26,14 @@ import java.util.function.Consumer;
 @CrossOrigin
 public class WebConfig implements WebMvcConfigurer {
     private final MappingJackson2HttpMessageConverter customJsonHttpConverter;
+    private final String sameSite;
 
     @Autowired
-    public WebConfig(@Qualifier("customJsonHttpConverter") MappingJackson2HttpMessageConverter customJsonHttpConverter) {
+    public WebConfig(@Qualifier("customJsonHttpConverter") MappingJackson2HttpMessageConverter customJsonHttpConverter,
+                     BackendApiSettings backendSettings
+    ) {
         this.customJsonHttpConverter = customJsonHttpConverter;
+        this.sameSite = backendSettings.getSecurity().getSameSite();
     }
 
     @Override
@@ -79,6 +85,16 @@ public class WebConfig implements WebMvcConfigurer {
 
     @Bean
     public CookieSameSiteSupplier applicationCookieSameSiteSupplier() {
-        return CookieSameSiteSupplier.ofNone();
+        if (sameSite == null) {
+            return null;
+        } else if (sameSite.equalsIgnoreCase(Cookie.SameSite.NONE.attributeValue())) {
+            return CookieSameSiteSupplier.ofNone();
+        } else if (sameSite.equalsIgnoreCase(Cookie.SameSite.LAX.attributeValue())) {
+            return CookieSameSiteSupplier.ofNone();
+        } else if (sameSite.equalsIgnoreCase(Cookie.SameSite.STRICT.attributeValue())) {
+            return CookieSameSiteSupplier.ofStrict();
+        } else {
+            throw new IllegalStateException("unknown SameSite setting");
+        }
     }
 }
diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java
index e805b0671..b0346ffd0 100644
--- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java
+++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java
@@ -70,7 +70,7 @@ public class ClearingCorsFilter extends OncePerRequestFilter {
 //                } else {
 //                    methods = "*";
 //                }
-//                setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, methods);
+                setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, "*");
 
 //                String headers;
 //                if (head.length > 0) {
@@ -78,7 +78,7 @@ public class ClearingCorsFilter extends OncePerRequestFilter {
 //                } else {
 //                    headers = "*";
 //                }
-//                setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, headers);
+                setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, "*");
 
                 setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
                 log.trace("cors filter -> added ok");
diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/element/SecuritySettings.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/element/SecuritySettings.java
index d2b48b879..ac66f3ee8 100644
--- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/element/SecuritySettings.java
+++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/element/SecuritySettings.java
@@ -2,6 +2,7 @@ package ru.spcex.clearing.backendapi.security.element;
 
 public class SecuritySettings {
     private Boolean authorizationDisabled = false;
+    private String sameSite;
 
     public Boolean getAuthorizationDisabled() {
         return authorizationDisabled;
@@ -10,4 +11,12 @@ public class SecuritySettings {
     public void setAuthorizationDisabled(Boolean authorizationDisabled) {
         this.authorizationDisabled = authorizationDisabled;
     }
+
+    public String getSameSite() {
+        return sameSite;
+    }
+
+    public void setSameSite(String sameSite) {
+        this.sameSite = sameSite;
+    }
 }