diff --git a/spoolman/env.py b/spoolman/env.py
index dc90bdf..50aafd0 100644
--- a/spoolman/env.py
+++ b/spoolman/env.py
@@ -210,6 +210,7 @@ def is_debug_mode() -> bool:
         return True
     raise ValueError(f"Failed to parse SPOOLMAN_DEBUG_MODE variable: Unknown debug mode '{debug_mode}'.")
 
+
 def is_cors_defined() -> bool:
     """Get whether CORS is enabled from environment variables.
 
@@ -221,10 +222,8 @@ def is_cors_defined() -> bool:
 
     """
     cors = os.getenv("SPOOLMAN_CORS_ORIGIN", "FALSE").upper()
-    if cors in {"FALSE", "0"}:
-        return False
-    else:
-        return True
+    return cors not in {"FALSE", "0"}
+
 
 def get_cors_origin() -> Optional[list[str]]:
     """Get the CORS origin from environment variables.
@@ -240,6 +239,7 @@ def get_cors_origin() -> Optional[list[str]]:
         return None
     return cors.split(",")
 
+
 def is_automatic_backup_enabled() -> bool:
     """Get whether automatic backup is enabled from environment variables.
 
diff --git a/spoolman/main.py b/spoolman/main.py
index 6e71607..69c3236 100644
--- a/spoolman/main.py
+++ b/spoolman/main.py
@@ -103,13 +103,23 @@ window.SPOOLMAN_BASE_PATH = "{base_path}";
 # Mount the client side app
 app.mount(base_path, app=SinglePageApplication(directory="client/dist", base_path=env.get_base_path()))
 
-# Allow all origins if in debug mode
-if env.is_debug_mode() or env.is_cors_defined():
-    if(env.is_cors_defined()):
-        origins = env.get_cors_origin()
-    else:
-        origins = ["*"]
+
+def add_cors_middleware() -> None:
+    """Add CORS middleware to the FastAPI app based on environment settings."""
+    origins = []
+    if env.is_debug_mode():
         logger.warning("Running in debug mode, allowing all origins.")
+        origins = ["*"]
+    elif env.is_cors_defined():
+        cors_origins = env.get_cors_origin()
+        if cors_origins:
+            logger.info("CORS origins defined: %s", cors_origins)
+            origins = cors_origins
+        else:
+            logger.warning("CORS origins are not defined, no CORS will be applied.")
+
+    if not origins:
+        return
 
     app.add_middleware(
         CORSMiddleware,
@@ -121,6 +131,9 @@ if env.is_debug_mode() or env.is_cors_defined():
     )
 
 
+add_cors_middleware()
+
+
 def add_file_logging() -> None:
     """Add file logging to the root logger."""
     # Define a file logger with log rotation