diff --git a/based/Cargo.lock b/based/Cargo.lock
index f328c5046..5059b2947 100644
--- a/based/Cargo.lock
+++ b/based/Cargo.lock
@@ -1271,6 +1271,7 @@ dependencies = [
  "serde_json",
  "tokio",
  "tower 0.4.13",
+ "tower-http",
  "tracing",
 ]
 
diff --git a/based/Cargo.toml b/based/Cargo.toml
index 476a6864b..50ad2259a 100644
--- a/based/Cargo.toml
+++ b/based/Cargo.toml
@@ -119,6 +119,7 @@ thiserror = "2.0.11"
 tokio = { version = "1.43.0", features = ["full"] }
 toml = "0.8.19"
 tower = "0.4"
+tower-http = { version = "0.6.4", features = ["cors"] }
 tracing = "0.1.41"
 tracing-appender = "0.2.3"
 tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
diff --git a/based/bin/portal/Cargo.toml b/based/bin/portal/Cargo.toml
index 04cda129b..1d32f9671 100644
--- a/based/bin/portal/Cargo.toml
+++ b/based/bin/portal/Cargo.toml
@@ -20,4 +20,5 @@ reth-rpc-layer.workspace = true
 serde_json.workspace = true
 tokio.workspace = true
 tower.workspace = true
+tower-http.workspace = true
 tracing.workspace = true
diff --git a/based/bin/portal/src/server.rs b/based/bin/portal/src/server.rs
index 86fdf0ef4..684b86d04 100644
--- a/based/bin/portal/src/server.rs
+++ b/based/bin/portal/src/server.rs
@@ -25,6 +25,8 @@ use parking_lot::RwLock;
 use reqwest::Url;
 use reth_rpc_layer::{AuthClientLayer, AuthClientService, JwtSecret};
 use tokio::sync::Mutex;
+use tower::ServiceBuilder;
+use tower_http::cors::{Any, CorsLayer};
 use tracing::{Instrument, Level, debug, error, info, trace};
 
 use crate::{cli::PortalArgs, middleware::ProxyService};
@@ -136,10 +138,15 @@ impl PortalServer {
             )
         });
 
+        // temp: remove when factoring out the portal
+        let cors = CorsLayer::new().allow_origin(Any).allow_methods(Any).allow_headers(Any);
+        let cors_middleware = ServiceBuilder::new().layer(cors);
+
         let server = ServerBuilder::default()
             .max_request_body_size(u32::MAX)
             .max_response_body_size(u32::MAX)
             .set_rpc_middleware(rpc_middleware)
+            .set_http_middleware(cors_middleware)
             .build(addr)
             .await?;