diff --git a/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.test.ts b/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.test.ts
index 1c70d020c4..113b2a8ee6 100644
--- a/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.test.ts
+++ b/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.test.ts
@@ -18,6 +18,12 @@ import { ConfigReader } from '@backstage/config';
 import { readCorsOptions } from './readCorsOptions';
 
 describe('readCorsOptions', () => {
+  it('should be disabled by default', () => {
+    expect(readCorsOptions(new ConfigReader({}))).toEqual({
+      origin: false,
+    });
+  });
+
   it('reads single string', () => {
     const mockCallback = jest.fn();
     const config = new ConfigReader({ cors: { origin: 'https://*.value*' } });
diff --git a/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.ts b/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.ts
index 17c3157ebd..809ee9b527 100644
--- a/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.ts
+++ b/packages/backend-app-api/src/services/implementations/rootHttpRouter/readCorsOptions.ts
@@ -29,10 +29,10 @@ import { Minimatch } from 'minimatch';
  * const corsOptions = readCorsOptions(config.getConfig('backend'));
  * ```
  */
-export function readCorsOptions(config: Config): CorsOptions | undefined {
+export function readCorsOptions(config: Config): CorsOptions {
   const cc = config.getOptionalConfig('cors');
   if (!cc) {
-    return undefined;
+    return { origin: false }; // Disable CORS
   }
 
   return {