diff --git a/.env.dist b/.env.dist
index 3f05e8d8..61b5da2e 100644
--- a/.env.dist
+++ b/.env.dist
@@ -25,3 +25,7 @@ DATABASE_URL=sqlite:///%kernel.project_dir%/var/data/kimai.sqlite
 # Delivery is disabled by default via "null://localhost"
 MAILER_URL=null://localhost
 ###< symfony/swiftmailer-bundle ###
+
+###> nelmio/cors-bundle ###
+CORS_ALLOW_ORIGIN=^https?://localhost(:[0-9]+)?$
+###< nelmio/cors-bundle ###
diff --git a/UPGRADING.md b/UPGRADING.md
index c1383c97..290f40d8 100644
--- a/UPGRADING.md
+++ b/UPGRADING.md
@@ -30,6 +30,10 @@ The table prefix is now hardcoded to `kimai2_`. If you used another prefix, you
 before starting the update process. You can also delete the row `DATABASE_PREFIX` from your `.env` file.
 - API: DateTime objects will be returned including timezone identifier (previously 2019-03-02 14:23 - now 2019-03-02T14:23:00+00:00)
 
+**Check if you want to apply changes to your `local.yaml`:** 
+
+- New permission is available available: `system_configuration`
+
 ## [0.8.1](https://github.com/kevinpapst/kimai2/releases/tag/0.8.1)
 
 A bug fixing release. Remember to execute the necessary timezone conversion script, if you haven't updated to 0.8 before (see below)!
diff --git a/composer.json b/composer.json
index 71d03348..e4b7c9c9 100644
--- a/composer.json
+++ b/composer.json
@@ -23,6 +23,7 @@
         "kimai/kimai2-composer": "^0.1",
         "mpdf/mpdf": "^7.1",
         "nelmio/api-doc-bundle": "^3.2",
+        "nelmio/cors-bundle": "^1.5",
         "ocramius/proxy-manager": "2.1.1",
         "phpoffice/phpspreadsheet": "^1.4",
         "phpoffice/phpword": "^0.15.0",
diff --git a/composer.lock b/composer.lock
index cc18a868..faa0a363 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "df4ac341f40ef97bcd3b78174125b1c5",
+    "content-hash": "89fb63af4a70745a81b734b4a3efb494",
     "packages": [
         {
             "name": "beberlei/DoctrineExtensions",
@@ -2826,6 +2826,64 @@
             ],
             "time": "2019-01-25T17:25:46+00:00"
         },
+        {
+            "name": "nelmio/cors-bundle",
+            "version": "1.5.5",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/nelmio/NelmioCorsBundle.git",
+                "reference": "adabee944e6fe52ee566caf1770a29355b1e8d83"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/nelmio/NelmioCorsBundle/zipball/adabee944e6fe52ee566caf1770a29355b1e8d83",
+                "reference": "adabee944e6fe52ee566caf1770a29355b1e8d83",
+                "shasum": ""
+            },
+            "require": {
+                "symfony/framework-bundle": "^2.7 || ^3.0 || ^4.0"
+            },
+            "require-dev": {
+                "matthiasnoback/symfony-dependency-injection-test": "^1.0 || ^2.0",
+                "mockery/mockery": "^0.9 || ^1.0",
+                "symfony/phpunit-bridge": "^2.7 || ^3.0 || ^4.0"
+            },
+            "type": "symfony-bundle",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "1.5.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Nelmio\\CorsBundle\\": ""
+                },
+                "exclude-from-classmap": [
+                    "/Tests/"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nelmio",
+                    "homepage": "http://nelm.io"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://github.com/nelmio/NelmioCorsBundle/contributors"
+                }
+            ],
+            "description": "Adds CORS (Cross-Origin Resource Sharing) headers support in your Symfony2 application",
+            "keywords": [
+                "api",
+                "cors",
+                "crossdomain"
+            ],
+            "time": "2019-02-27T13:13:15+00:00"
+        },
         {
             "name": "nikic/php-parser",
             "version": "v4.2.0",
diff --git a/config/bundles.php b/config/bundles.php
index fe946c9a..5a1e6072 100644
--- a/config/bundles.php
+++ b/config/bundles.php
@@ -22,4 +22,5 @@ return [
     FOS\UserBundle\FOSUserBundle::class => ['all' => true],
     FOS\RestBundle\FOSRestBundle::class => ['all' => true],
     Nelmio\ApiDocBundle\NelmioApiDocBundle::class => ['all' => true],
+    Nelmio\CorsBundle\NelmioCorsBundle::class => ['all' => true],
 ];
diff --git a/config/packages/nelmio_cors.yaml b/config/packages/nelmio_cors.yaml
new file mode 100644
index 00000000..15092e22
--- /dev/null
+++ b/config/packages/nelmio_cors.yaml
@@ -0,0 +1,21 @@
+nelmio_cors:
+    defaults:
+        allow_credentials: false
+        allow_origin: ['%env(CORS_ALLOW_ORIGIN)%']
+        allow_headers: []
+#        allow_headers: ['Content-Type', 'Authorization', 'X-AUTH-USER', 'X-AUTH-TOKEN']
+        allow_methods: []
+#        allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
+        expose_headers: []
+#        expose_headers: ['Link']
+        max_age: 0
+#        max_age: 3600
+        hosts: []
+        origin_regex: true
+        forced_allow_origin_value: ~
+    paths:
+        '^/api/':
+            allow_origin: ['*']
+            allow_headers: ['X-AUTH-USER', 'X-AUTH-TOKEN']
+            allow_methods: ['GET', 'OPTIONS', 'POST', 'PUT', 'PATCH', 'DELETE']
+            max_age: 3600
diff --git a/phpunit.xml.dist b/phpunit.xml.dist
index bfdd3017..b71ed518 100644
--- a/phpunit.xml.dist
+++ b/phpunit.xml.dist
@@ -25,6 +25,10 @@
         <!-- ###+ symfony/swiftmailer-bundle ### -->
         <env name="MAILER_URL" value="null://localhost" force="true"/>
         <!-- ###- symfony/swiftmailer-bundle ### -->
+
+        <!-- ###+ nelmio/cors-bundle ### -->
+        <env name="CORS_ALLOW_ORIGIN" value="^https?://localhost(:[0-9]+)?$"/>
+        <!-- ###- nelmio/cors-bundle ### -->
     </php>
 
     <testsuites>
diff --git a/symfony.lock b/symfony.lock
index 11c38aee..d3b9a3b8 100644
--- a/symfony.lock
+++ b/symfony.lock
@@ -194,6 +194,15 @@
             "ref": "c8e0c38e1a280ab9e37587a8fa32b251d5bc1c94"
         }
     },
+    "nelmio/cors-bundle": {
+        "version": "1.5",
+        "recipe": {
+            "repo": "github.com/symfony/recipes",
+            "branch": "master",
+            "version": "1.5",
+            "ref": "f0436fc35fca88eada758311f8de43bfb61f1980"
+        }
+    },
     "nikic/php-parser": {
         "version": "v4.0.2"
     },