diff --git a/packages/core/server/src/__tests__/helper.test.ts b/packages/core/server/src/__tests__/helper.test.ts
new file mode 100644
index 00000000000..2ba55728631
--- /dev/null
+++ b/packages/core/server/src/__tests__/helper.test.ts
@@ -0,0 +1,36 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+import { resolveCorsOrigin } from '../helper';
+
+describe('resolveCorsOrigin', () => {
+  const origin = 'https://portal.example.com';
+
+  afterEach(() => {
+    delete process.env.CORS_ORIGIN_WHITELIST;
+  });
+
+  it('allows every origin when the whitelist contains an asterisk', () => {
+    process.env.CORS_ORIGIN_WHITELIST = '*';
+
+    expect(resolveCorsOrigin({ get: () => origin })).toBe(origin);
+  });
+
+  it('allows an asterisk alongside explicit origins', () => {
+    process.env.CORS_ORIGIN_WHITELIST = 'https://admin.example.com, *';
+
+    expect(resolveCorsOrigin({ get: () => origin })).toBe(origin);
+  });
+
+  it('keeps exact matching when the whitelist does not contain an asterisk', () => {
+    process.env.CORS_ORIGIN_WHITELIST = 'https://admin.example.com';
+
+    expect(resolveCorsOrigin({ get: () => origin })).toBe(false);
+  });
+});
diff --git a/packages/core/server/src/helper.ts b/packages/core/server/src/helper.ts
index 50b0d148ded..382e6a8691a 100644
--- a/packages/core/server/src/helper.ts
+++ b/packages/core/server/src/helper.ts
@@ -51,12 +51,13 @@ function isWhitelistedCorsOrigin(ctx: any) {
     return isTrustedOrigin(ctx, origin);
   }
 
-  return whitelist.has(origin);
+  return whitelist.has('*') || whitelist.has(origin);
 }
 
-function resolveCorsOrigin(ctx: any) {
+export function resolveCorsOrigin(ctx: any) {
   const origin = ctx.get('origin');
   const disallowNoOrigin = process.env.CORS_DISALLOW_NO_ORIGIN === 'true';
+  const whitelist = getCorsWhitelist();
 
   if (!origin && disallowNoOrigin) {
     return false;
@@ -66,7 +67,7 @@ function resolveCorsOrigin(ctx: any) {
     return origin;
   }
 
-  return getCorsWhitelist() ? false : origin;
+  return whitelist ? false : origin;
 }
 
 export function registerMiddlewares(app: Application, options: ApplicationOptions) {