diff --git a/back/src/Controller/AuthenticateController.ts b/back/src/Controller/AuthenticateController.ts
index 9cfffab5..16919b22 100644
--- a/back/src/Controller/AuthenticateController.ts
+++ b/back/src/Controller/AuthenticateController.ts
@@ -28,8 +28,6 @@ export class AuthenticateController extends BaseController {
 
         this.App.post("/register", (res: HttpResponse, req: HttpRequest) => {
             (async () => {
-                this.addCorsHeaders(res);
-
                 res.onAborted(() => {
                     console.warn('Login request was aborted');
                 })
@@ -50,7 +48,9 @@ export class AuthenticateController extends BaseController {
                     const mapUrlStart = data.mapUrlStart;
 
                     const authToken = jwtTokenManager.createJWTToken(userUuid);
-                    res.writeStatus("200 OK").end(JSON.stringify({
+                    res.writeStatus("200 OK");
+                    this.addCorsHeaders(res);
+                    res.end(JSON.stringify({
                         authToken,
                         userUuid,
                         organizationSlug,
@@ -61,7 +61,9 @@ export class AuthenticateController extends BaseController {
 
                 } catch (e) {
                     console.log("An error happened", e)
-                    res.writeStatus(e.status || "500 Internal Server Error").end('An error happened');
+                    res.writeStatus(e.status || "500 Internal Server Error");
+                    this.addCorsHeaders(res);
+                    res.end('An error happened');
                 }
 
 
@@ -79,8 +81,6 @@ export class AuthenticateController extends BaseController {
 
         this.App.get("/verify", (res: HttpResponse, req: HttpRequest) => {
             (async () => {
-                this.addCorsHeaders(res);
-
                 const query = parse(req.getQuery());
 
                 res.onAborted(() => {
@@ -90,12 +90,17 @@ export class AuthenticateController extends BaseController {
                 try {
                     await jwtTokenManager.getUserUuidFromToken(query.token as string);
                 } catch (e) {
-                    res.writeStatus("400 Bad Request").end(JSON.stringify({
+                    res.writeStatus("400 Bad Request");
+                    this.addCorsHeaders(res);
+                    res.end(JSON.stringify({
                         "success": false,
                         "message": "Invalid JWT token"
                     }));
+                    return;
                 }
-                res.writeStatus("200 OK").end(JSON.stringify({
+                res.writeStatus("200 OK");
+                this.addCorsHeaders(res);
+                res.end(JSON.stringify({
                     "success": true
                 }));
             })();
@@ -112,7 +117,6 @@ export class AuthenticateController extends BaseController {
         });
 
         this.App.post("/anonymLogin", (res: HttpResponse, req: HttpRequest) => {
-            this.addCorsHeaders(res);
 
             res.onAborted(() => {
                 console.warn('Login request was aborted');
@@ -120,7 +124,9 @@ export class AuthenticateController extends BaseController {
 
             const userUuid = v4();
             const authToken = jwtTokenManager.createJWTToken(userUuid);
-            res.writeStatus("200 OK").end(JSON.stringify({
+            res.writeStatus("200 OK");
+            this.addCorsHeaders(res);
+            res.end(JSON.stringify({
                 authToken,
                 userUuid,
             }));
diff --git a/back/src/Controller/FileController.ts b/back/src/Controller/FileController.ts
index 87b72b80..ae914aa8 100644
--- a/back/src/Controller/FileController.ts
+++ b/back/src/Controller/FileController.ts
@@ -44,8 +44,6 @@ export class FileController extends BaseController {
 
         this.App.post("/upload-audio-message", (res: HttpResponse, req: HttpRequest) => {
             (async () => {
-                this.addCorsHeaders(res);
-
                 res.onAborted(() => {
                     console.warn('upload-audio-message request was aborted');
                 })
@@ -80,14 +78,18 @@ export class FileController extends BaseController {
                         }
                     });
 
-                    res.writeStatus("200 OK").end(JSON.stringify({
+                    res.writeStatus("200 OK");
+                    this.addCorsHeaders(res);
+                    res.end(JSON.stringify({
                         id: audioMessageId,
                         path: `/download-audio-message/${audioMessageId}`
                     }));
 
                 } catch (e) {
                     console.log("An error happened", e)
-                    res.writeStatus(e.status || "500 Internal Server Error").end('An error happened');
+                    res.writeStatus(e.status || "500 Internal Server Error");
+                    this.addCorsHeaders(res);
+                    res.end('An error happened');
                 }
             })();
         });
@@ -101,7 +103,6 @@ export class FileController extends BaseController {
         });
 
         this.App.get("/download-audio-message/:id", (res: HttpResponse, req: HttpRequest) => {
-            this.addCorsHeaders(res);
 
             res.onAborted(() => {
                 console.warn('upload-audio-message request was aborted');
@@ -111,7 +112,9 @@ export class FileController extends BaseController {
 
             const file = this.uploadedFileBuffers.get(id);
             if (file === undefined) {
-                res.writeStatus("404 Not found").end("Cannot find file");
+                res.writeStatus("404 Not found");
+                this.addCorsHeaders(res);
+                res.end("Cannot find file");
                 return;
             }
 
diff --git a/back/src/Controller/MapController.ts b/back/src/Controller/MapController.ts
index 86e3790f..027fc5b8 100644
--- a/back/src/Controller/MapController.ts
+++ b/back/src/Controller/MapController.ts
@@ -24,7 +24,6 @@ export class MapController extends BaseController{
         });
 
         this.App.get("/map", (res: HttpResponse, req: HttpRequest) => {
-            this.addCorsHeaders(res);
 
             res.onAborted(() => {
                 console.warn('/map request was aborted');
@@ -34,25 +33,35 @@ export class MapController extends BaseController{
 
             if (typeof query.organizationSlug !== 'string') {
                 console.error('Expected organizationSlug parameter');
-                res.writeStatus("400 Bad request").end("Expected organizationSlug parameter");
+                res.writeStatus("400 Bad request");
+                this.addCorsHeaders(res);
+                res.end("Expected organizationSlug parameter");
             }
             if (typeof query.worldSlug !== 'string') {
                 console.error('Expected worldSlug parameter');
-                res.writeStatus("400 Bad request").end("Expected worldSlug parameter");
+                res.writeStatus("400 Bad request");
+                this.addCorsHeaders(res);
+                res.end("Expected worldSlug parameter");
             }
             if (typeof query.roomSlug !== 'string' && query.roomSlug !== undefined) {
                 console.error('Expected only one roomSlug parameter');
-                res.writeStatus("400 Bad request").end("Expected only one roomSlug parameter");
+                res.writeStatus("400 Bad request");
+                this.addCorsHeaders(res);
+                res.end("Expected only one roomSlug parameter");
             }
 
             (async () => {
                 try {
                     const mapDetails = await adminApi.fetchMapDetails(query.organizationSlug as string, query.worldSlug as string, query.roomSlug as string|undefined);
 
-                    res.writeStatus("200 OK").end(JSON.stringify(mapDetails));
+                    res.writeStatus("200 OK");
+                    this.addCorsHeaders(res);
+                    res.end(JSON.stringify(mapDetails));
                 } catch (e) {
                     console.error(e);
-                    res.writeStatus("500 Internal Server Error").end("An error occurred");
+                    res.writeStatus("500 Internal Server Error")
+                    this.addCorsHeaders(res);
+                    res.end("An error occurred");
                 }
             })();