diff --git a/eeg_backend/src/main/java/at/mueller/eeg/backend/iam/config/SecurityConfig.java b/eeg_backend/src/main/java/at/mueller/eeg/backend/iam/config/SecurityConfig.java
index 16f95ac..609d4b8 100644
--- a/eeg_backend/src/main/java/at/mueller/eeg/backend/iam/config/SecurityConfig.java
+++ b/eeg_backend/src/main/java/at/mueller/eeg/backend/iam/config/SecurityConfig.java
@@ -77,9 +77,7 @@ public class SecurityConfig {
     @Bean
     public JwtAuthenticationConverter jwtAuthenticationConverter() {
         JwtGrantedAuthoritiesConverter grantedAuthoritiesConverter = new JwtGrantedAuthoritiesConverter();
-        // Hier sagst du Spring, wie das Feld in deinem JWT-Payload heißt (z.B. "role" oder "roles")
         grantedAuthoritiesConverter.setAuthoritiesClaimName("role");
-        // Spring Security erwartet bei Rollen immer das Prefix "ROLE_"
         grantedAuthoritiesConverter.setAuthorityPrefix("ROLE_");
 
         JwtAuthenticationConverter jwtAuthenticationConverter = new JwtAuthenticationConverter();
@@ -93,7 +91,7 @@ public class SecurityConfig {
     @Bean
     public CorsConfigurationSource corsConfigurationSource() {
         CorsConfiguration configuration = new CorsConfiguration();
-        configuration.setAllowedOrigins(Arrays.stream(corsOrigins.split(",")).map(String::trim).toList());
+        configuration.setAllowedOriginPatterns(Arrays.stream(corsOrigins.split(",")).map(String::trim).toList());
         configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"));
         configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type", "X-Access-Token"));
         configuration.setAllowCredentials(true);
diff --git a/eeg_backend/src/main/resources/application-dev.yml b/eeg_backend/src/main/resources/application-dev.yml
index 83d5236..a0827ae 100644
--- a/eeg_backend/src/main/resources/application-dev.yml
+++ b/eeg_backend/src/main/resources/application-dev.yml
@@ -12,7 +12,10 @@ spring:
 jwt:
   secret: dev-only-secret-do-not-use-in-production-2025
 app:
-  cors-origins: http://localhost:4200,https://eeg.mueller-dev.com,https://*.eeg.mueller-dev.com
+  cors-origins:
+  - http://localhost:4200
+  - https://eeg.mueller-dev.com
+  - https://*.eeg.mueller-dev.com
 eda:
   simulation:
     consent-delay-ms: 3000