diff --git a/src/RAG.Api/Endpoints/Auth/LoginEndpoint.cs b/src/RAG.Api/Endpoints/Auth/LoginEndpoint.cs
index 8afa0c5..9dae81c 100644
--- a/src/RAG.Api/Endpoints/Auth/LoginEndpoint.cs
+++ b/src/RAG.Api/Endpoints/Auth/LoginEndpoint.cs
@@ -25,8 +25,8 @@ public class LoginEndpoint(IMediator mediator) : Endpoint<LoginRequest, TokenRes
         HttpContext.Response.Cookies.Append("jwt", result.RefreshToken, new CookieOptions
         {
             HttpOnly = true,
-            Secure = true,
-            SameSite = SameSiteMode.None,
+            Secure = false,
+            SameSite = SameSiteMode.Lax,
             Expires = DateTimeOffset.UtcNow.AddDays(7),
             Path = "/"
         });
diff --git a/src/RAG.Api/Endpoints/Auth/RefreshTokenEndpoint.cs b/src/RAG.Api/Endpoints/Auth/RefreshTokenEndpoint.cs
index 8934113..0dc48b1 100644
--- a/src/RAG.Api/Endpoints/Auth/RefreshTokenEndpoint.cs
+++ b/src/RAG.Api/Endpoints/Auth/RefreshTokenEndpoint.cs
@@ -31,8 +31,8 @@ public class RefreshTokenEndpoint(IMediator mediator) : EndpointWithoutRequest<s
         HttpContext.Response.Cookies.Append("jwt", result.RefreshToken, new CookieOptions
         {
             HttpOnly = true,
-            Secure = true,
-            SameSite = SameSiteMode.None,
+            Secure = false,
+            SameSite = SameSiteMode.Lax,
             Expires = DateTimeOffset.UtcNow.AddDays(7),
             Path = "/"
         });
diff --git a/src/RAG.Api/RAGApiModule.cs b/src/RAG.Api/RAGApiModule.cs
index f091d85..d923ced 100644
--- a/src/RAG.Api/RAGApiModule.cs
+++ b/src/RAG.Api/RAGApiModule.cs
@@ -45,7 +45,7 @@ public class RAGApiModule : AbpModule
         {
             options.AddDefaultPolicy(policy =>
             {
-                policy.WithOrigins("http://localhost:5173", "http://localhost:5174", "http://localhost:3000")
+                policy.WithOrigins("http://localhost:5173", "http://localhost:5174", "http://localhost:3000", "http://localhost:5666")
                     .AllowAnyHeader()
                     .AllowAnyMethod()
                     .AllowCredentials();