diff --git a/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowCredentialsHeaderProvider.php b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowCredentialsHeaderProvider.php
new file mode 100644
index 0000000000000..ba2e995d4f704
--- /dev/null
+++ b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowCredentialsHeaderProvider.php
@@ -0,0 +1,71 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\GraphQl\Controller\HttpResponse\Cors;
+
+use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
+use Magento\GraphQl\Model\Cors\ConfigurationInterface;
+
+/**
+ * Provides value for Access-Control-Allow-Credentials header if CORS is enabled
+ */
+class CorsAllowCredentialsHeaderProvider implements HeaderProviderInterface
+{
+    /**
+     * @var string
+     */
+    private $headerName;
+
+    /**
+     * CORS configuration provider
+     *
+     * @var \Magento\GraphQl\Model\Cors\ConfigurationInterface
+     */
+    private $corsConfiguration;
+
+    /**
+     * @param ConfigurationInterface $corsConfiguration
+     * @param string $headerName
+     */
+    public function __construct(
+        ConfigurationInterface $corsConfiguration,
+        string $headerName
+    ) {
+        $this->corsConfiguration = $corsConfiguration;
+        $this->headerName = $headerName;
+    }
+
+    /**
+     * Get name of header
+     *
+     * @return string
+     */
+    public function getName(): string
+    {
+        return $this->headerName;
+    }
+
+    /**
+     * Get value for header
+     *
+     * @return string
+     */
+    public function getValue(): string
+    {
+        return "1";
+    }
+
+    /**
+     * Check if header can be applied
+     *
+     * @return bool
+     */
+    public function canApply(): bool
+    {
+        return $this->corsConfiguration->isEnabled() && $this->corsConfiguration->isCredentialsAllowed();
+    }
+}
diff --git a/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowHeadersHeaderProvider.php b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowHeadersHeaderProvider.php
new file mode 100644
index 0000000000000..68760de543daa
--- /dev/null
+++ b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowHeadersHeaderProvider.php
@@ -0,0 +1,71 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\GraphQl\Controller\HttpResponse\Cors;
+
+use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
+use Magento\GraphQl\Model\Cors\ConfigurationInterface;
+
+/**
+ * Provides value for Access-Control-Allow-Headers header if CORS is enabled
+ */
+class CorsAllowHeadersHeaderProvider implements HeaderProviderInterface
+{
+    /**
+     * @var string
+     */
+    private $headerName;
+
+    /**
+     * CORS configuration provider
+     *
+     * @var \Magento\GraphQl\Model\Cors\ConfigurationInterface
+     */
+    private $corsConfiguration;
+
+    /**
+     * @param ConfigurationInterface $corsConfiguration
+     * @param string $headerName
+     */
+    public function __construct(
+        ConfigurationInterface $corsConfiguration,
+        string $headerName
+    ) {
+        $this->corsConfiguration = $corsConfiguration;
+        $this->headerName = $headerName;
+    }
+
+    /**
+     * Get name of header
+     *
+     * @return string
+     */
+    public function getName(): string
+    {
+        return $this->headerName;
+    }
+
+    /**
+     * Check if header can be applied
+     *
+     * @return bool
+     */
+    public function canApply(): bool
+    {
+        return $this->corsConfiguration->isEnabled() && $this->getValue();
+    }
+
+    /**
+     * Get value for header
+     *
+     * @return string|null
+     */
+    public function getValue(): ?string
+    {
+        return $this->corsConfiguration->getAllowedHeaders();
+    }
+}
diff --git a/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowMethodsHeaderProvider.php b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowMethodsHeaderProvider.php
new file mode 100644
index 0000000000000..233839b9deb74
--- /dev/null
+++ b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowMethodsHeaderProvider.php
@@ -0,0 +1,71 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\GraphQl\Controller\HttpResponse\Cors;
+
+use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
+use Magento\GraphQl\Model\Cors\ConfigurationInterface;
+
+/**
+ * Provides value for Access-Control-Allow-Methods header if CORS is enabled
+ */
+class CorsAllowMethodsHeaderProvider implements HeaderProviderInterface
+{
+    /**
+     * @var string
+     */
+    private $headerName;
+
+    /**
+     * CORS configuration provider
+     *
+     * @var \Magento\GraphQl\Model\Cors\ConfigurationInterface
+     */
+    private $corsConfiguration;
+
+    /**
+     * @param ConfigurationInterface $corsConfiguration
+     * @param string $headerName
+     */
+    public function __construct(
+        ConfigurationInterface $corsConfiguration,
+        string $headerName
+    ) {
+        $this->corsConfiguration = $corsConfiguration;
+        $this->headerName = $headerName;
+    }
+
+    /**
+     * Get name of header
+     *
+     * @return string
+     */
+    public function getName(): string
+    {
+        return $this->headerName;
+    }
+
+    /**
+     * Check if header can be applied
+     *
+     * @return bool
+     */
+    public function canApply(): bool
+    {
+        return $this->corsConfiguration->isEnabled() && $this->getValue();
+    }
+
+    /**
+     * Get value for header
+     *
+     * @return string|null
+     */
+    public function getValue(): ?string
+    {
+        return $this->corsConfiguration->getAllowedMethods();
+    }
+}
diff --git a/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowOriginHeaderProvider.php b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowOriginHeaderProvider.php
new file mode 100644
index 0000000000000..21850f18db1f2
--- /dev/null
+++ b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsAllowOriginHeaderProvider.php
@@ -0,0 +1,71 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\GraphQl\Controller\HttpResponse\Cors;
+
+use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
+use Magento\GraphQl\Model\Cors\ConfigurationInterface;
+
+/**
+ * Provides value for Access-Control-Allow-Origin header if CORS is enabled
+ */
+class CorsAllowOriginHeaderProvider implements HeaderProviderInterface
+{
+    /**
+     * @var string
+     */
+    private $headerName;
+
+    /**
+     * CORS configuration provider
+     *
+     * @var \Magento\GraphQl\Model\Cors\ConfigurationInterface
+     */
+    private $corsConfiguration;
+
+    /**
+     * @param ConfigurationInterface $corsConfiguration
+     * @param string $headerName
+     */
+    public function __construct(
+        ConfigurationInterface $corsConfiguration,
+        string $headerName
+    ) {
+        $this->corsConfiguration = $corsConfiguration;
+        $this->headerName = $headerName;
+    }
+
+    /**
+     * Get name of header
+     *
+     * @return string
+     */
+    public function getName(): string
+    {
+        return $this->headerName;
+    }
+
+    /**
+     * Check if header can be applied
+     *
+     * @return bool
+     */
+    public function canApply(): bool
+    {
+        return $this->corsConfiguration->isEnabled() && $this->getValue();
+    }
+
+    /**
+     * Get value for header
+     *
+     * @return string|null
+     */
+    public function getValue(): ?string
+    {
+        return $this->corsConfiguration->getAllowedOrigins();
+    }
+}
diff --git a/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsMaxAgeHeaderProvider.php b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsMaxAgeHeaderProvider.php
new file mode 100644
index 0000000000000..e30209ae25e68
--- /dev/null
+++ b/app/code/Magento/GraphQl/Controller/HttpResponse/Cors/CorsMaxAgeHeaderProvider.php
@@ -0,0 +1,71 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\GraphQl\Controller\HttpResponse\Cors;
+
+use Magento\Framework\App\Response\HeaderProvider\HeaderProviderInterface;
+use Magento\GraphQl\Model\Cors\ConfigurationInterface;
+
+/**
+ * Provides value for Access-Control-Max-Age header if CORS is enabled
+ */
+class CorsMaxAgeHeaderProvider implements HeaderProviderInterface
+{
+    /**
+     * @var string
+     */
+    private $headerName;
+
+    /**
+     * CORS configuration provider
+     *
+     * @var \Magento\GraphQl\Model\Cors\ConfigurationInterface
+     */
+    private $corsConfiguration;
+
+    /**
+     * @param ConfigurationInterface $corsConfiguration
+     * @param string $headerName
+     */
+    public function __construct(
+        ConfigurationInterface $corsConfiguration,
+        string $headerName
+    ) {
+        $this->corsConfiguration = $corsConfiguration;
+        $this->headerName = $headerName;
+    }
+
+    /**
+     * Get name of header
+     *
+     * @return string
+     */
+    public function getName(): string
+    {
+        return $this->headerName;
+    }
+
+    /**
+     * Check if header can be applied
+     *
+     * @return bool
+     */
+    public function canApply(): bool
+    {
+        return $this->corsConfiguration->isEnabled() && $this->getValue();
+    }
+
+    /**
+     * Get value for header
+     *
+     * @return string|null
+     */
+    public function getValue(): ?string
+    {
+        return (string) $this->corsConfiguration->getMaxAge();
+    }
+}
diff --git a/app/code/Magento/GraphQl/Model/Cors/Configuration.php b/app/code/Magento/GraphQl/Model/Cors/Configuration.php
new file mode 100644
index 0000000000000..dd5a0b426e22d
--- /dev/null
+++ b/app/code/Magento/GraphQl/Model/Cors/Configuration.php
@@ -0,0 +1,96 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\GraphQl\Model\Cors;
+
+use Magento\Framework\App\Config\ScopeConfigInterface;
+
+/**
+ * Configuration provider for GraphQL CORS settings
+ */
+class Configuration implements ConfigurationInterface
+{
+    public const XML_PATH_CORS_HEADERS_ENABLED = 'graphql/cors/enabled';
+    public const XML_PATH_CORS_ALLOWED_ORIGINS = 'graphql/cors/allowed_origins';
+    public const XML_PATH_CORS_ALLOWED_HEADERS = 'graphql/cors/allowed_headers';
+    public const XML_PATH_CORS_ALLOWED_METHODS = 'graphql/cors/allowed_methods';
+    public const XML_PATH_CORS_MAX_AGE = 'graphql/cors/max_age';
+    public const XML_PATH_CORS_ALLOW_CREDENTIALS = 'graphql/cors/allow_credentials';
+
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @param ScopeConfigInterface $scopeConfig
+     */
+    public function __construct(ScopeConfigInterface $scopeConfig)
+    {
+        $this->scopeConfig = $scopeConfig;
+    }
+
+    /**
+     * Are CORS headers enabled
+     *
+     * @return bool
+     */
+    public function isEnabled(): bool
+    {
+        return $this->scopeConfig->isSetFlag(self::XML_PATH_CORS_HEADERS_ENABLED);
+    }
+
+    /**
+     * Get allowed origins or null if stored configuration is empty
+     *
+     * @return string|null
+     */
+    public function getAllowedOrigins(): ?string
+    {
+        return $this->scopeConfig->getValue(self::XML_PATH_CORS_ALLOWED_ORIGINS);
+    }
+
+    /**
+     * Get allowed headers or null if stored configuration is empty
+     *
+     * @return string|null
+     */
+    public function getAllowedHeaders(): ?string
+    {
+        return $this->scopeConfig->getValue(self::XML_PATH_CORS_ALLOWED_HEADERS);
+    }
+
+    /**
+     * Get allowed methods or null if stored configuration is empty
+     *
+     * @return string|null
+     */
+    public function getAllowedMethods(): ?string
+    {
+        return $this->scopeConfig->getValue(self::XML_PATH_CORS_ALLOWED_METHODS);
+    }
+
+    /**
+     * Get max age header value
+     *
+     * @return int
+     */
+    public function getMaxAge(): int
+    {
+        return (int) $this->scopeConfig->getValue(self::XML_PATH_CORS_MAX_AGE);
+    }
+
+    /**
+     * Are credentials allowed
+     *
+     * @return bool
+     */
+    public function isCredentialsAllowed(): bool
+    {
+        return $this->scopeConfig->isSetFlag(self::XML_PATH_CORS_ALLOW_CREDENTIALS);
+    }
+}
diff --git a/app/code/Magento/GraphQl/Model/Cors/ConfigurationInterface.php b/app/code/Magento/GraphQl/Model/Cors/ConfigurationInterface.php
new file mode 100644
index 0000000000000..b40b64f48e51f
--- /dev/null
+++ b/app/code/Magento/GraphQl/Model/Cors/ConfigurationInterface.php
@@ -0,0 +1,56 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\GraphQl\Model\Cors;
+
+/**
+ * Interface for configuration provider for GraphQL CORS settings
+ */
+interface ConfigurationInterface
+{
+    /**
+     * Are CORS headers enabled
+     *
+     * @return bool
+     */
+    public function isEnabled(): bool;
+
+    /**
+     * Get allowed origins or null if stored configuration is empty
+     *
+     * @return string|null
+     */
+    public function getAllowedOrigins(): ?string;
+
+    /**
+     * Get allowed headers or null if stored configuration is empty
+     *
+     * @return string|null
+     */
+    public function getAllowedHeaders(): ?string;
+
+    /**
+     * Get allowed methods or null if stored configuration is empty
+     *
+     * @return string|null
+     */
+    public function getAllowedMethods(): ?string;
+
+    /**
+     * Get max age header value
+     *
+     * @return int
+     */
+    public function getMaxAge(): int;
+
+    /**
+     * Are credentials allowed
+     *
+     * @return bool
+     */
+    public function isCredentialsAllowed() : bool;
+}
diff --git a/app/code/Magento/GraphQl/etc/adminhtml/system.xml b/app/code/Magento/GraphQl/etc/adminhtml/system.xml
new file mode 100644
index 0000000000000..ddee7596eca3e
--- /dev/null
+++ b/app/code/Magento/GraphQl/etc/adminhtml/system.xml
@@ -0,0 +1,65 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Config:etc/system_file.xsd">
+    <system>
+        <section id="graphql" translate="label" type="text" sortOrder="300" showInDefault="1" showInWebsite="1" showInStore="1">
+            <label>GraphQL</label>
+            <tab>service</tab>
+            <resource>Magento_Integration::config_oauth</resource>
+            <group id="cors" translate="label" type="text" sortOrder="60" showInDefault="1" showInWebsite="1">
+                <label>CORS Settings</label>
+                <field id="enabled" translate="label" type="select" sortOrder="1" showInDefault="1" canRestore="1">
+                    <label>CORS Headers Enabled</label>
+                    <source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
+                </field>
+
+                <field id="allowed_origins" translate="label" type="text" sortOrder="10" showInDefault="1" canRestore="1">
+                    <label>Allowed origins</label>
+                    <comment>The Access-Control-Allow-Origin response header indicates whether the response can be shared with requesting code from the given origin. Fill this field with one or more origins (comma separated) or use '*' to allow access from all origins.</comment>
+                    <depends>
+                        <field id="graphql/cors/enabled">1</field>
+                    </depends>
+                </field>
+
+                <field id="allowed_methods" translate="label" type="text" sortOrder="20" showInDefault="1" canRestore="1">
+                    <label>Allowed methods</label>
+                    <comment>The Access-Control-Allow-Methods response header specifies the method or methods allowed when accessing the resource in response to a preflight request. Use comma separated methods (e.g. GET,POST)</comment>
+                    <depends>
+                        <field id="graphql/cors/enabled">1</field>
+                    </depends>
+                </field>
+
+                <field id="allowed_headers" translate="label" type="text" sortOrder="30" showInDefault="1" canRestore="1">
+                    <label>Allowed headers</label>
+                    <comment>The Access-Control-Allow-Headers response header is used in response to a preflight request which includes the Access-Control-Request-Headers to indicate which HTTP headers can be used during the actual request. Use comma separated headers.</comment>
+                    <depends>
+                        <field id="graphql/cors/enabled">1</field>
+                    </depends>
+                </field>
+
+                <field id="max_age" translate="label" type="text" sortOrder="40" showInDefault="1" canRestore="1">
+                    <label>Max Age</label>
+                    <validate>validate-digits</validate>
+                    <comment>The Access-Control-Max-Age response header indicates how long the results of a preflight request (that is the information contained in the Access-Control-Allow-Methods and Access-Control-Allow-Headers headers) can be cached.</comment>
+                    <depends>
+                        <field id="graphql/cors/enabled">1</field>
+                    </depends>
+                </field>
+
+                <field id="allow_credentials" translate="label" type="select" sortOrder="50" showInDefault="1" canRestore="1">
+                    <label>Credentials Allowed</label>
+                    <source_model>Magento\Config\Model\Config\Source\Yesno</source_model>
+                    <comment>The Access-Control-Allow-Credentials response header tells browsers whether to expose the response to frontend code when the request's credentials mode is include.</comment>
+                    <depends>
+                        <field id="graphql/cors/enabled">1</field>
+                    </depends>
+                </field>
+            </group>
+        </section>
+    </system>
+</config>
diff --git a/app/code/Magento/GraphQl/etc/config.xml b/app/code/Magento/GraphQl/etc/config.xml
new file mode 100644
index 0000000000000..39caacbec42d2
--- /dev/null
+++ b/app/code/Magento/GraphQl/etc/config.xml
@@ -0,0 +1,22 @@
+<?xml version="1.0"?>
+<!--
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Store:etc/config.xsd">
+    <default>
+        <graphql>
+            <cors>
+                <enabled>0</enabled>
+                <allowed_origins></allowed_origins>
+                <allowed_methods></allowed_methods>
+                <allowed_headers></allowed_headers>
+                <max_age>86400</max_age>
+                <allow_credentials>0</allow_credentials>
+            </cors>
+        </graphql>
+    </default>
+</config>
diff --git a/app/code/Magento/GraphQl/etc/di.xml b/app/code/Magento/GraphQl/etc/di.xml
index b356f33c4f4bf..fca6c425e2507 100644
--- a/app/code/Magento/GraphQl/etc/di.xml
+++ b/app/code/Magento/GraphQl/etc/di.xml
@@ -98,4 +98,31 @@
             <argument name="queryComplexity" xsi:type="number">300</argument>
         </arguments>
     </type>
+
+    <preference for="Magento\GraphQl\Model\Cors\ConfigurationInterface" type="Magento\GraphQl\Model\Cors\Configuration" />
+    <type name="Magento\GraphQl\Controller\HttpResponse\Cors\CorsMaxAgeHeaderProvider">
+        <arguments>
+            <argument name="headerName" xsi:type="string">Access-Control-Max-Age</argument>
+        </arguments>
+    </type>
+    <type name="Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowCredentialsHeaderProvider">
+        <arguments>
+            <argument name="headerName" xsi:type="string">Access-Control-Allow-Credentials</argument>
+        </arguments>
+    </type>
+    <type name="Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowHeadersHeaderProvider">
+        <arguments>
+            <argument name="headerName" xsi:type="string">Access-Control-Allow-Headers</argument>
+        </arguments>
+    </type>
+    <type name="Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowMethodsHeaderProvider">
+        <arguments>
+            <argument name="headerName" xsi:type="string">Access-Control-Allow-Methods</argument>
+        </arguments>
+    </type>
+    <type name="Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowOriginHeaderProvider">
+        <arguments>
+            <argument name="headerName" xsi:type="string">Access-Control-Allow-Origin</argument>
+        </arguments>
+    </type>
 </config>
diff --git a/app/code/Magento/GraphQl/etc/graphql/di.xml b/app/code/Magento/GraphQl/etc/graphql/di.xml
index 77fce336374dd..23d49124d1a02 100644
--- a/app/code/Magento/GraphQl/etc/graphql/di.xml
+++ b/app/code/Magento/GraphQl/etc/graphql/di.xml
@@ -30,4 +30,15 @@
             </argument>
         </arguments>
     </type>
+    <type name="Magento\Framework\App\Response\HeaderManager">
+        <arguments>
+            <argument name="headerProviderList" xsi:type="array">
+                <item name="CorsAllowOrigins" xsi:type="object">Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowOriginHeaderProvider</item>
+                <item name="CorsAllowHeaders" xsi:type="object">Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowHeadersHeaderProvider</item>
+                <item name="CorsAllowMethods" xsi:type="object">Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowMethodsHeaderProvider</item>
+                <item name="CorsAllowCredentials" xsi:type="object">Magento\GraphQl\Controller\HttpResponse\Cors\CorsAllowCredentialsHeaderProvider</item>
+                <item name="CorsMaxAge" xsi:type="object">Magento\GraphQl\Controller\HttpResponse\Cors\CorsMaxAgeHeaderProvider</item>
+            </argument>
+        </arguments>
+    </type>
 </config>
diff --git a/dev/tests/api-functional/testsuite/Magento/GraphQl/CorsHeadersTest.php b/dev/tests/api-functional/testsuite/Magento/GraphQl/CorsHeadersTest.php
new file mode 100644
index 0000000000000..25c808a549e80
--- /dev/null
+++ b/dev/tests/api-functional/testsuite/Magento/GraphQl/CorsHeadersTest.php
@@ -0,0 +1,126 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+declare(strict_types=1);
+
+namespace Magento\GraphQl;
+
+use Magento\Config\Model\ResourceModel\Config;
+use Magento\Framework\App\Config\ReinitableConfigInterface;
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\GraphQl\Model\Cors\Configuration;
+use Magento\TestFramework\ObjectManager;
+use Magento\TestFramework\TestCase\GraphQlAbstract;
+
+class CorsHeadersTest extends GraphQlAbstract
+{
+    /**
+     * @var Config $config
+     */
+    private $resourceConfig;
+    /**
+     * @var ReinitableConfigInterface
+     */
+    private $reinitConfig;
+    /**
+     * @var ScopeConfigInterface
+     */
+    private $scopeConfig;
+
+    /**
+     * @inheritdoc
+     */
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $objectManager = ObjectManager::getInstance();
+
+        $this->resourceConfig = $objectManager->get(Config::class);
+        $this->reinitConfig = $objectManager->get(ReinitableConfigInterface::class);
+        $this->scopeConfig = $objectManager->get(ScopeConfigInterface::class);
+    }
+
+    protected function tearDown(): void
+    {
+        parent::tearDown();
+
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_HEADERS_ENABLED, 0);
+        $this->reinitConfig->reinit();
+    }
+
+    public function testNoCorsHeadersWhenCorsIsDisabled(): void
+    {
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_HEADERS_ENABLED, 0);
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOWED_HEADERS, 'Origin');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOW_CREDENTIALS, '1');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOWED_METHODS, 'GET,POST');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOWED_ORIGINS, 'magento.local');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_MAX_AGE, '86400');
+        $this->reinitConfig->reinit();
+
+        $headers = $this->getHeadersFromIntrospectionQuery();
+
+        self::assertArrayNotHasKey('Access-Control-Max-Age', $headers);
+        self::assertArrayNotHasKey('Access-Control-Allow-Credentials', $headers);
+        self::assertArrayNotHasKey('Access-Control-Allow-Headers', $headers);
+        self::assertArrayNotHasKey('Access-Control-Allow-Methods', $headers);
+        self::assertArrayNotHasKey('Access-Control-Allow-Origin', $headers);
+    }
+
+    public function testCorsHeadersWhenCorsIsEnabled(): void
+    {
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_HEADERS_ENABLED, 1);
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOWED_HEADERS, 'Origin');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOW_CREDENTIALS, '1');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOWED_METHODS, 'GET,POST');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOWED_ORIGINS, 'magento.local');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_MAX_AGE, '86400');
+        $this->reinitConfig->reinit();
+
+        $headers = $this->getHeadersFromIntrospectionQuery();
+
+        self::assertEquals('Origin', $headers['Access-Control-Allow-Headers']);
+        self::assertEquals('1', $headers['Access-Control-Allow-Credentials']);
+        self::assertEquals('GET,POST', $headers['Access-Control-Allow-Methods']);
+        self::assertEquals('magento.local', $headers['Access-Control-Allow-Origin']);
+        self::assertEquals('86400', $headers['Access-Control-Max-Age']);
+    }
+
+    public function testEmptyCorsHeadersWhenCorsIsEnabled(): void
+    {
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_HEADERS_ENABLED, 1);
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOWED_HEADERS, '');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOW_CREDENTIALS, '');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOWED_METHODS, '');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_ALLOWED_ORIGINS, '');
+        $this->resourceConfig->saveConfig(Configuration::XML_PATH_CORS_MAX_AGE, '');
+        $this->reinitConfig->reinit();
+
+        $headers = $this->getHeadersFromIntrospectionQuery();
+
+        self::assertArrayNotHasKey('Access-Control-Max-Age', $headers);
+        self::assertArrayNotHasKey('Access-Control-Allow-Credentials', $headers);
+        self::assertArrayNotHasKey('Access-Control-Allow-Headers', $headers);
+        self::assertArrayNotHasKey('Access-Control-Allow-Methods', $headers);
+        self::assertArrayNotHasKey('Access-Control-Allow-Origin', $headers);
+    }
+
+    private function getHeadersFromIntrospectionQuery(): array
+    {
+        $query
+            = <<<QUERY
+ query IntrospectionQuery {
+    __schema {
+        types {
+        name
+        }
+    }
+  }
+QUERY;
+
+        return $this->graphQlQueryWithResponseHeaders($query)['headers'] ?? [];
+    }
+}