diff --git a/core/src/main/java/com/github/kr328/clash/core/model/ConfigurationOverride.kt b/core/src/main/java/com/github/kr328/clash/core/model/ConfigurationOverride.kt
index bceef3f2..3587a1d8 100644
--- a/core/src/main/java/com/github/kr328/clash/core/model/ConfigurationOverride.kt
+++ b/core/src/main/java/com/github/kr328/clash/core/model/ConfigurationOverride.kt
@@ -47,6 +47,9 @@ data class ConfigurationOverride(
     @SerialName("external-controller-tls")
     var externalControllerTLS: String? = null,
 
+    @SerialName("external-controller-cors")
+    var externalControllerCors: ExternalControllerCors = ExternalControllerCors(),
+
     @SerialName("secret")
     var secret: String? = null,
 
@@ -210,6 +213,15 @@ data class ConfigurationOverride(
         var geosite: String? = null,
     )
 
+    @Serializable
+    data class ExternalControllerCors(
+        @SerialName("allow-origins")
+        var allowOrigins: List<String>? = null,
+
+        @SerialName("allow-private-network")
+        var allowPrivateNetwork: Boolean? = null,
+    )
+
     override fun writeToParcel(parcel: Parcel, flags: Int) {
         Parcelizer.encodeToParcel(serializer(), parcel, this)
     }
diff --git a/design/src/main/java/com/github/kr328/clash/design/OverrideSettingsDesign.kt b/design/src/main/java/com/github/kr328/clash/design/OverrideSettingsDesign.kt
index 1b91ce4a..e35944ca 100644
--- a/design/src/main/java/com/github/kr328/clash/design/OverrideSettingsDesign.kt
+++ b/design/src/main/java/com/github/kr328/clash/design/OverrideSettingsDesign.kt
@@ -157,6 +157,20 @@ class OverrideSettingsDesign(
                 empty = R.string.default_
             )
 
+            editableTextList(
+                value = configuration.externalControllerCors::allowOrigins,
+                adapter = TextAdapter.String,
+                title = R.string.allow_origins,
+                placeholder = R.string.dont_modify,
+            )
+
+            selectableList(
+                value = configuration.externalControllerCors::allowPrivateNetwork,
+                values = booleanValues,
+                valuesText = booleanValuesText,
+                title = R.string.allow_private_network,
+            )
+
             editableText(
                 value = configuration::secret,
                 adapter = NullableTextAdapter.String,
diff --git a/design/src/main/res/values/strings.xml b/design/src/main/res/values/strings.xml
index 783d980f..622adbb9 100644
--- a/design/src/main/res/values/strings.xml
+++ b/design/src/main/res/values/strings.xml
@@ -150,6 +150,8 @@
     <string name="ipv6">IPv6</string>
     <string name="external_controller">External Controller</string>
     <string name="external_controller_tls">External Controller TLS</string>
+    <string name="allow_origins">External Controller Allow Origins</string>
+    <string name="allow_private_network">External Controller Allow Private Network</string>
     <string name="secret">Secret</string>
     <string name="hosts">Hosts</string>
     <string name="_new">New</string>