diff --git a/next.config.js b/next.config.js
index 8e9ddad2..bb8b6f54 100644
--- a/next.config.js
+++ b/next.config.js
@@ -1,5 +1,17 @@
 const { withPlausibleProxy } = require('next-plausible')
 
+const isProd = process.env.NODE_ENV === 'production'
+const corsHeaders = [
+  {
+    key: 'Access-Control-Allow-Origin',
+    value: isProd ? 'https://stacker.news' : 'http://localhost:3000'
+  },
+  {
+    key: 'Access-Control-Allow-Methods',
+    value: 'GET, PUT, POST, DELETE, HEAD, OPTIONS'
+  }
+]
+
 module.exports = withPlausibleProxy()({
   compress: false,
   experimental: {
@@ -8,11 +20,21 @@ module.exports = withPlausibleProxy()({
   generateBuildId: process.env.NODE_ENV === 'development'
     ? undefined
     : async () => {
-      // use the app version which eb doesn't otherwise give us
-      // as the build id
-    const { RuntimeSources } = require('/opt/elasticbeanstalk/deployment/app_version_manifest.json') // eslint-disable-line
+    // use the app version which eb doesn't otherwise give us
+    // as the build id
+      const { RuntimeSources } = require('/opt/elasticbeanstalk/deployment/app_version_manifest.json') // eslint-disable-line
       return Object.keys(RuntimeSources['stacker.news'])[0]
     },
+  // Use the CDN in production and localhost for development.
+  // assetPrefix: isProd ? 'https://a.stacker.news' : '',
+  async headers () {
+    return [
+      {
+        source: '/_next/:asset*',
+        headers: corsHeaders
+      }
+    ]
+  },
   async rewrites () {
     return [
       {