diff --git a/bin/server.js b/bin/server.js
index d235a15..d6966a4 100644
--- a/bin/server.js
+++ b/bin/server.js
@@ -68,6 +68,11 @@ class Server {
       app.use(passport.initialize())
       app.use(passport.session())
 
+      // Enable CORS for testing
+      // THIS IS A SECURITY RISK. COMMENT OUT FOR PRODUCTION
+      // Dev Note: This line must come BEFORE controllers.attachRESTControllers()
+      app.use(cors({ origin: '*' }))
+
       // Attach REST API and JSON RPC controllers to the app.
       const Controllers = require('../src/controllers')
       const controllers = new Controllers()
@@ -75,10 +80,6 @@ class Server {
 
       app.controllers = controllers
 
-      // Enable CORS for testing
-      // THIS IS A SECURITY RISK. COMMENT OUT FOR PRODUCTION
-      app.use(cors({ origin: '*' }))
-
       // MIDDLEWARE END
 
       console.log(`Running server in environment: ${config.env}`)