diff --git a/eeg_backend/src/main/java/at/mueller/eeg/backend/iam/config/SecurityConfig.java b/eeg_backend/src/main/java/at/mueller/eeg/backend/iam/config/SecurityConfig.java
index 75cad0b..978a434 100644
--- a/eeg_backend/src/main/java/at/mueller/eeg/backend/iam/config/SecurityConfig.java
+++ b/eeg_backend/src/main/java/at/mueller/eeg/backend/iam/config/SecurityConfig.java
@@ -3,7 +3,10 @@ package at.mueller.eeg.backend.iam.config;
 import at.mueller.eeg.backend.iam.repository.UserRepository;
 import com.nimbusds.jose.jwk.source.ImmutableSecret;
 import jakarta.servlet.DispatcherType;
+import lombok.Getter;
+import lombok.Setter;
 import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
@@ -31,6 +34,7 @@ import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
 import javax.crypto.spec.SecretKeySpec;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.stream.Stream;
@@ -38,13 +42,15 @@ import java.util.stream.Stream;
 @Configuration
 @EnableWebSecurity
 @EnableMethodSecurity
+@ConfigurationProperties(prefix = "app")
 public class SecurityConfig {
 
     @Value("${jwt.secret}")
     private String jwtSecret;
 
-    @Value("${app.cors-origins:http://localhost:4200}")
-    private List<String> corsOrigins;
+    @Setter
+    @Getter
+    private List<String> corsOrigins = new ArrayList<>();
 
     @Bean
     public JwtDecoder jwtDecoder() {