diff --git a/docker-compose/nginx.conf b/docker-compose/nginx.conf
index 39ecdbad7..c6dae2f41 100644
--- a/docker-compose/nginx.conf
+++ b/docker-compose/nginx.conf
@@ -7,6 +7,7 @@ events {
 http {
   access_log /var/log/nginx/access.log;
   error_log /var/log/nginx/error.log;
+
   server {
     listen 3000;
     server_name  localhost;
@@ -27,6 +28,8 @@ http {
       proxy_set_header   X-Real-IP $remote_addr;
       proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header   X-Forwarded-Host $server_name;
+      add_header Content-Security-Policy "default-src 'none'" always;
+      add_header Referrer-Policy "no-referrer" always;
     }
     location /.well-known/openid-configuration {
       proxy_pass         http://esignet:8088/v1/esignet/oidc/.well-known/openid-configuration;
@@ -35,6 +38,14 @@ http {
       proxy_set_header   X-Real-IP $remote_addr;
       proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header   X-Forwarded-Host $server_name;
+      add_header Content-Security-Policy "default-src 'none'" always;
+      add_header Referrer-Policy "no-referrer" always;
+      add_header 'Access-Control-Allow-Origin' '*' always;
+      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
+      types {
+        text/plain log cer json txt;
+      }
     }
     location /.well-known/jwks.json {
       proxy_pass         http://esignet:8088/v1/esignet/oauth/.well-known/jwks.json;
@@ -43,6 +54,14 @@ http {
       proxy_set_header   X-Real-IP $remote_addr;
       proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header   X-Forwarded-Host $server_name;
+      add_header Content-Security-Policy "default-src 'none'" always;
+      add_header Referrer-Policy "no-referrer" always;
+      add_header 'Access-Control-Allow-Origin' '*' always;
+      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
+      types {
+        text/plain log cer json txt;
+      }
     }
     location /.well-known/oauth-authorization-server {
       proxy_pass         http://esignet:8088/v1/esignet/oauth/.well-known/oauth-authorization-server;
@@ -51,6 +70,14 @@ http {
       proxy_set_header   X-Real-IP $remote_addr;
       proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header   X-Forwarded-Host $server_name;
+      add_header Content-Security-Policy "default-src 'none'" always;
+      add_header Referrer-Policy "no-referrer" always;
+      add_header 'Access-Control-Allow-Origin' '*' always;
+      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
+      types {
+        text/plain log cer json txt;
+      }
     }
     location /.well-known/openid-credential-issuer {
       proxy_pass         http://esignet:8088/v1/esignet/vci/.well-known/openid-credential-issuer;
@@ -59,6 +86,14 @@ http {
       proxy_set_header   X-Real-IP $remote_addr;
       proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header   X-Forwarded-Host $server_name;
+      add_header Content-Security-Policy "default-src 'none'" always;
+      add_header Referrer-Policy "no-referrer" always;
+      add_header 'Access-Control-Allow-Origin' '*' always;
+      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
+      types {
+        text/plain log cer json txt;
+      }
     }
     # location /oidc-ui {
     #   alias /usr/share/nginx/oidc-ui;
@@ -67,6 +102,16 @@ http {
     location / {
       # alias /usr/share/nginx/html;
       try_files $uri $uri/ /index.html;
+      add_header Content-Security-Policy "
+          default-src 'self';
+          style-src 'self' https://fonts.googleapis.com 'unsafe-inline';
+          font-src 'self' https://fonts.gstatic.com;
+          img-src 'self' data: https://cdn.jsdelivr.net https://*.mosip.net;
+          script-src 'self' https://www.google.com  https://www.gstatic.com;
+          frame-src https://www.google.com;
+          connect-src 'self' http://127.0.0.1:*;
+        " always;
+      add_header Referrer-Policy "no-referrer" always;
     }
   }
 }
\ No newline at end of file
diff --git a/helm/oidc-ui/templates/configmap.yaml b/helm/oidc-ui/templates/configmap.yaml
index f2b3891cf..e95d7f707 100644
--- a/helm/oidc-ui/templates/configmap.yaml
+++ b/helm/oidc-ui/templates/configmap.yaml
@@ -21,6 +21,7 @@ data:
     http {
       access_log /var/log/nginx/access1.log;
       error_log /var/log/nginx/error1.log;
+
       server {
         listen {{ .Values.oidc_ui.oidc_ui_port }};
         server_name  localhost;
@@ -54,6 +55,9 @@ data:
           proxy_set_header   X-Forwarded-Host $server_name;
           add_header Content-Security-Policy "default-src 'none'" always;
           add_header Referrer-Policy "no-referrer" always;
+          add_header 'Access-Control-Allow-Origin' '*' always;
+          add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+          add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
           types {
             text/plain log cer json txt;
           }
@@ -68,6 +72,9 @@ data:
           proxy_set_header   X-Forwarded-Host $server_name;
           add_header Content-Security-Policy "default-src 'none'" always;
           add_header Referrer-Policy "no-referrer" always;
+          add_header 'Access-Control-Allow-Origin' '*' always;
+          add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+          add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
           types {
             text/plain log cer json txt;
           }
@@ -82,6 +89,9 @@ data:
           proxy_set_header   X-Forwarded-Host $server_name;
           add_header Content-Security-Policy "default-src 'none'" always;
           add_header Referrer-Policy "no-referrer" always;
+          add_header 'Access-Control-Allow-Origin' '*' always;
+          add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+          add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
           types {
             text/plain log cer json txt;
           }
@@ -96,6 +106,9 @@ data:
           proxy_set_header   X-Forwarded-Host $server_name;
           add_header Content-Security-Policy "default-src 'none'" always;
           add_header Referrer-Policy "no-referrer" always;
+          add_header 'Access-Control-Allow-Origin' '*' always;
+          add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+          add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
           types {
             text/plain log cer json txt;
           }
diff --git a/oidc-ui/nginx/nginx.conf b/oidc-ui/nginx/nginx.conf
index b4d2cfa7c..a874a89bf 100644
--- a/oidc-ui/nginx/nginx.conf
+++ b/oidc-ui/nginx/nginx.conf
@@ -7,6 +7,7 @@ events {
 http {
   access_log /var/log/nginx/access.log;
   error_log /var/log/nginx/error.log;
+
   server {
     listen 3000;
     server_name  localhost;
@@ -40,6 +41,12 @@ http {
       proxy_set_header   X-Forwarded-Host $server_name;
       add_header Content-Security-Policy "default-src 'none'" always;
       add_header Referrer-Policy "no-referrer" always;
+      add_header 'Access-Control-Allow-Origin' '*' always;
+      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
+      types {
+        text/plain log cer json txt;
+      }
     }
     location /.well-known/jwks.json {
       proxy_pass         http://esignet.esignet/v1/esignet/oauth/.well-known/jwks.json;
@@ -50,6 +57,12 @@ http {
       proxy_set_header   X-Forwarded-Host $server_name;
       add_header Content-Security-Policy "default-src 'none'" always;
       add_header Referrer-Policy "no-referrer" always;
+      add_header 'Access-Control-Allow-Origin' '*' always;
+      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
+      types {
+        text/plain log cer json txt;
+      }
     }
     location /.well-known/oauth-authorization-server {
       proxy_pass         http://esignet.esignet/v1/esignet/oauth/.well-known/oauth-authorization-server;
@@ -60,6 +73,12 @@ http {
       proxy_set_header   X-Forwarded-Host $server_name;
       add_header Content-Security-Policy "default-src 'none'" always;
       add_header Referrer-Policy "no-referrer" always;
+      add_header 'Access-Control-Allow-Origin' '*' always;
+      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
+      types {
+        text/plain log cer json txt;
+      }
     }
     location /.well-known/openid-credential-issuer {
       proxy_pass         http://esignet.esignet/v1/esignet/vci/.well-known/openid-credential-issuer;
@@ -70,6 +89,12 @@ http {
       proxy_set_header   X-Forwarded-Host $server_name;
       add_header Content-Security-Policy "default-src 'none'" always;
       add_header Referrer-Policy "no-referrer" always;
+      add_header 'Access-Control-Allow-Origin' '*' always;
+      add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
+      add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
+      types {
+        text/plain log cer json txt;
+      }
     }
     # location /oidc-ui {
     #   alias /usr/share/nginx/oidc-ui;