diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/MyProjectNameHttpApiHostModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/MyProjectNameHttpApiHostModule.cs
index aaaa808b72..cdf4e08d92 100644
--- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/MyProjectNameHttpApiHostModule.cs
+++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/MyProjectNameHttpApiHostModule.cs
@@ -1,4 +1,6 @@
-using System.IO;
+using System;
+using System.IO;
+using System.Linq;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Hosting;
@@ -27,6 +29,8 @@ namespace MyCompanyName.MyProjectName
         )]
     public class MyProjectNameHttpApiHostModule : AbpModule
     {
+        private const string DefaultCorsPolicyName = "Default";
+
         public override void ConfigureServices(ServiceConfigurationContext context)
         {
             var configuration = context.Services.GetConfiguration();
@@ -38,6 +42,7 @@ namespace MyCompanyName.MyProjectName
             ConfigureLocalization();
             ConfigureVirtualFileSystem(context);
             ConfigureRedis(context, configuration, hostingEnvironment);
+            ConfigureCors(context, configuration);
         }
 
         private void ConfigureVirtualFileSystem(ServiceConfigurationContext context)
@@ -116,10 +121,33 @@ namespace MyCompanyName.MyProjectName
             }
         }
 
+        private void ConfigureCors(ServiceConfigurationContext context, IConfigurationRoot configuration)
+        {
+            context.Services.AddCors(options =>
+            {
+                options.AddPolicy(DefaultCorsPolicyName, builder =>
+                {
+                    builder
+                        .WithOrigins(
+                            configuration["App:CorsOrigins"]
+                                .Split(",", StringSplitOptions.RemoveEmptyEntries)
+                                .Select(o => o.RemovePostFix("/"))
+                                .ToArray()
+                        )
+                        .SetIsOriginAllowedToAllowWildcardSubdomains()
+                        .AllowAnyHeader()
+                        .AllowAnyMethod()
+                        .AllowCredentials();
+                });
+            });
+        }
+
         public override void OnApplicationInitialization(ApplicationInitializationContext context)
         {
             var app = context.GetApplicationBuilder();
 
+            app.UseCors(DefaultCorsPolicyName);
+
             app.UseVirtualFiles();
             app.UseAuthentication();
             if (MultiTenancyConsts.IsEnabled)
diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/appsettings.json b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/appsettings.json
index 2f6399ac58..bad453f08a 100644
--- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/appsettings.json
+++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.HttpApi.Host/appsettings.json
@@ -1,4 +1,7 @@
 {
+  "App": {
+    "CorsOrigins": "https://*.MyProjectName.com,http://localhost:4200"
+  },
   "ConnectionStrings": {
     "Default": "Server=localhost;Database=MyProjectName;Trusted_Connection=True;MultipleActiveResultSets=true"
   },
diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/MyProjectNameIdentityServerModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/MyProjectNameIdentityServerModule.cs
index 62a2403773..4537a508c4 100644
--- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/MyProjectNameIdentityServerModule.cs
+++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/MyProjectNameIdentityServerModule.cs
@@ -1,8 +1,11 @@
-using System.IO;
+using System;
+using System.IO;
+using System.Linq;
 using Localization.Resources.AbpUi;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Hosting;
+using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
 using MyCompanyName.MyProjectName.EntityFrameworkCore;
 using MyCompanyName.MyProjectName.Localization;
@@ -33,6 +36,8 @@ namespace MyCompanyName.MyProjectName
         )]
     public class MyProjectNameIdentityServerModule : AbpModule
     {
+        private const string DefaultCorsPolicyName = "Default";
+
         public override void ConfigureServices(ServiceConfigurationContext context)
         {
             var hostingEnvironment = context.Services.GetHostingEnvironment();
@@ -78,7 +83,7 @@ namespace MyCompanyName.MyProjectName
 
             Configure<AppUrlOptions>(options =>
             {
-                options.Applications["MVC"].RootUrl = configuration["AppSelfUrl"];
+                options.Applications["MVC"].RootUrl = configuration["App:SelfUrl"];
             });
 
             Configure<BackgroundJobOptions>(options =>
@@ -98,12 +103,32 @@ namespace MyCompanyName.MyProjectName
                     .AddDataProtection()
                     .PersistKeysToStackExchangeRedis(redis, "MyProjectName-Protection-Keys");
             }
-        }
 
+            context.Services.AddCors(options =>
+            {
+                options.AddPolicy(DefaultCorsPolicyName, builder =>
+                {
+                    builder
+                        .WithOrigins(
+                            configuration["App:CorsOrigins"]
+                                .Split(",", StringSplitOptions.RemoveEmptyEntries)
+                                .Select(o => o.RemovePostFix("/"))
+                                .ToArray()
+                        )
+                        .SetIsOriginAllowedToAllowWildcardSubdomains()
+                        .AllowAnyHeader()
+                        .AllowAnyMethod()
+                        .AllowCredentials();
+                });
+            });
+        }
+        
         public override void OnApplicationInitialization(ApplicationInitializationContext context)
         {
             var app = context.GetApplicationBuilder();
 
+            app.UseCors(DefaultCorsPolicyName);
+
             app.UseCorrelationId();
             app.UseVirtualFiles();
             app.UseAuthentication();
diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/appsettings.json b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/appsettings.json
index 036a7fae3e..45f23d7895 100644
--- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/appsettings.json
+++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.IdentityServer/appsettings.json
@@ -1,5 +1,8 @@
 {
-  "AppSelfUrl": "https://localhost:44301",
+  "App": {
+    "SelfUrl": "https://localhost:44301",
+    "CorsOrigins": "https://*.MyProjectName.com,http://localhost:4200"
+  },
   "ConnectionStrings": {
     "Default": "Server=localhost;Database=MyProjectName;Trusted_Connection=True;MultipleActiveResultSets=true"
   },
diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web.Host/MyProjectNameWebModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web.Host/MyProjectNameWebModule.cs
index bbd3568405..07874a46e7 100644
--- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web.Host/MyProjectNameWebModule.cs
+++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web.Host/MyProjectNameWebModule.cs
@@ -81,7 +81,7 @@ namespace MyCompanyName.MyProjectName.Web
         {
             Configure<AppUrlOptions>(options =>
             {
-                options.Applications["MVC"].RootUrl = configuration["AppSelfUrl"];
+                options.Applications["MVC"].RootUrl = configuration["App:SelfUrl"];
             });
         }
 
diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web.Host/appsettings.json b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web.Host/appsettings.json
index 3e8f88f825..e9330b776e 100644
--- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web.Host/appsettings.json
+++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web.Host/appsettings.json
@@ -1,5 +1,7 @@
 {
-  "AppSelfUrl": "https://localhost:44302",
+  "App": {
+    "SelfUrl": "https://localhost:44302"
+  },
   "RemoteServices": {
     "Default": {
       "BaseUrl": "https://localhost:44300/"
diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyProjectNameWebModule.cs b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyProjectNameWebModule.cs
index 267d7d8d83..4858c3ebaf 100644
--- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyProjectNameWebModule.cs
+++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/MyProjectNameWebModule.cs
@@ -79,7 +79,7 @@ namespace MyCompanyName.MyProjectName.Web
         {
             Configure<AppUrlOptions>(options =>
             {
-                options.Applications["MVC"].RootUrl = configuration["AppSelfUrl"];
+                options.Applications["MVC"].RootUrl = configuration["App:SelfUrl"];
             });
         }
 
diff --git a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/appsettings.json b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/appsettings.json
index 99415d6a8f..085db27e0b 100644
--- a/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/appsettings.json
+++ b/templates/app/aspnet-core/src/MyCompanyName.MyProjectName.Web/appsettings.json
@@ -1,5 +1,7 @@
 {
-  "AppSelfUrl": "https://localhost:44303",
+  "App": {
+    "SelfUrl": "https://localhost:44303"
+  },
   "ConnectionStrings": {
     "Default": "Server=localhost;Database=MyProjectName;Trusted_Connection=True;MultipleActiveResultSets=true"
   },