diff --git a/bookshop/package.json b/bookshop/package.json
index b4896b7e..a0b3f3c9 100644
--- a/bookshop/package.json
+++ b/bookshop/package.json
@@ -5,6 +5,7 @@
   "dependencies": {
     "@capire/common": "*",
     "@sap/cds": "^4",
+    "cors": "^2.8.5",
     "express": "^4.17.1"
   },
   "scripts": {
diff --git a/bookshop/server.js b/bookshop/server.js
index 257b1b12..c062914f 100644
--- a/bookshop/server.js
+++ b/bookshop/server.js
@@ -4,11 +4,15 @@ const readFile = promisify(require('fs').readFile)
 const swaggerUi = require ('swagger-ui-express')
 const cds = require ('@sap/cds')
 const trace = cds.debug('openapi')
+const cors = require('cors')
 
 let app, host, docCache={}
 
 cds
-  .on ('bootstrap', _app => { app = _app })
+  .on ('bootstrap', _app => {
+    app = _app
+    app.use(cors())  // allow to be called from e.g. editor.swagger.io
+  })
   .on ('serving', service => {
     const apiPath = '/api-docs'+service.path
     console.log (`[Open API] - serving ${service.name} at ${apiPath}`)