diff --git a/bin/torii/src/main.rs b/bin/torii/src/main.rs
index a4f7923719..d3c85d63d7 100644
--- a/bin/torii/src/main.rs
+++ b/bin/torii/src/main.rs
@@ -87,9 +87,9 @@ struct Args {
 
     /// Specify allowed origins for api endpoints (comma-separated list of allowed origins, or "*"
     /// for all)
-    #[arg(long, default_value = "*")]
+    #[arg(long)]
     #[arg(value_delimiter = ',')]
-    allowed_origins: Vec<String>,
+    allowed_origins: Option<Vec<String>>,
 
     /// The external url of the server, used for configuring the GraphQL Playground in a hosted
     /// environment
diff --git a/crates/torii/server/src/proxy.rs b/crates/torii/server/src/proxy.rs
index 4d34fafa35..df9f4e26f5 100644
--- a/crates/torii/server/src/proxy.rs
+++ b/crates/torii/server/src/proxy.rs
@@ -54,7 +54,7 @@ lazy_static::lazy_static! {
 
 pub struct Proxy {
     addr: SocketAddr,
-    allowed_origins: Vec<String>,
+    allowed_origins: Option<Vec<String>>,
     grpc_addr: Option<SocketAddr>,
     graphql_addr: Arc<RwLock<Option<SocketAddr>>>,
 }
@@ -62,7 +62,7 @@ pub struct Proxy {
 impl Proxy {
     pub fn new(
         addr: SocketAddr,
-        allowed_origins: Vec<String>,
+        allowed_origins: Option<Vec<String>>,
         grpc_addr: Option<SocketAddr>,
         graphql_addr: Option<SocketAddr>,
     ) -> Self {
@@ -103,15 +103,23 @@ impl Proxy {
                         .collect::<Vec<HeaderName>>(),
                 );
 
-            let cors = match allowed_origins.as_slice() {
-                [origin] if origin == "*" => cors.allow_origin(AllowOrigin::mirror_request()),
-                origins => cors.allow_origin(
-                    origins.iter().map(|o| o.parse().expect("valid origin")).collect::<Vec<_>>(),
-                ),
-            };
+            let cors =
+                allowed_origins.clone().map(|allowed_origins| match allowed_origins.as_slice() {
+                    [origin] if origin == "*" => cors.allow_origin(AllowOrigin::mirror_request()),
+                    origins => cors.allow_origin(
+                        origins
+                            .iter()
+                            .map(|o| {
+                                let _ = o.parse::<http::Uri>().expect("Invalid URI");
+
+                                o.parse().expect("Invalid origin")
+                            })
+                            .collect::<Vec<_>>(),
+                    ),
+                });
 
             let graphql_addr_clone = graphql_addr.clone();
-            let service = ServiceBuilder::new().layer(cors).service_fn(move |req| {
+            let service = ServiceBuilder::new().option_layer(cors).service_fn(move |req| {
                 let graphql_addr = graphql_addr_clone.clone();
                 async move {
                     let graphql_addr = graphql_addr.read().await;