diff --git a/lib/jsonrpc-adapter.js b/lib/jsonrpc-adapter.js
index 1d2b7909..c13f3276 100644
--- a/lib/jsonrpc-adapter.js
+++ b/lib/jsonrpc-adapter.js
@@ -116,7 +116,7 @@ JsonRpcAdapter.prototype.createHandler = function () {
     urlencodedOptions.extended = true;
   }
   var jsonOptions = this.remotes.options.json || {strict: false};
-  var corsOptions = this.remotes.options.cors || {};
+  var corsOptions = this.remotes.options.cors || {origin: true, credentials: true};
   root.use(urlencoded(urlencodedOptions));
   root.use(json(jsonOptions));
   root.use(cors(corsOptions));
diff --git a/lib/rest-adapter.js b/lib/rest-adapter.js
index dea2cca5..a4cccdc2 100644
--- a/lib/rest-adapter.js
+++ b/lib/rest-adapter.js
@@ -208,7 +208,7 @@ RestAdapter.prototype.createHandler = function () {
     urlencodedOptions.extended = true;
   }
   var jsonOptions = this.remotes.options.json || {strict: false};
-  var corsOptions = this.remotes.options.cors || {};
+  var corsOptions = this.remotes.options.cors || {origin: true, credentials: true};
   root.use(urlencoded(urlencodedOptions));
   root.use(json(jsonOptions));
   root.use(cors(corsOptions));
diff --git a/test/rest.test.js b/test/rest.test.js
index a29379ac..1a304982 100644
--- a/test/rest.test.js
+++ b/test/rest.test.js
@@ -74,6 +74,30 @@ describe('strong-remoting-rest', function(){
         .expect(413, done);
     });
 
+    it('should support cors', function(done) {
+      var method = givenSharedStaticMethod(
+        function greet(msg, cb) {
+          cb(null, msg);
+        },
+        {
+          accepts: { arg: 'person', type: 'string', http: {source: 'body'} },
+          returns: { arg: 'msg', type: 'string' }
+        }
+      );
+
+      // Build an object that is larger than 1kb
+      var name = {person: 'ABC'};
+
+      request(app)['post'](method.url)
+        .set('Accept', 'application/json')
+        .set('Content-Type', 'application/json')
+        .set('Origin', 'http://localhost:3000')
+        .send(name)
+        .expect('Access-Control-Allow-Origin', 'http://localhost:3000')
+        .expect('Access-Control-Allow-Credentials', 'true')
+        .expect(200, done);
+    });
+
     it('should disable stack trace', function(done) {
       objects.options.errorHandler.disableStackTrace = true;
       var method = givenSharedStaticMethod(