diff --git a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java
index 2e4f64f2f1b..f1293ac0588 100644
--- a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java
+++ b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java
@@ -321,7 +321,7 @@ public static FilterHolder corsFilterHandle() {
                 CrossOriginFilter.ALLOWED_HEADERS_PARAM,
                 "X-Requested-With, X-Requested-By, Access-Control-Allow-Origin,"
                         + " Content-Type, Content-Length, Accept, Origin");
-        filterHolder.setInitParameter(CrossOriginFilter.ACCESS_CONTROL_ALLOW_ORIGIN_HEADER, "*");
+        filterHolder.setInitParameter(CrossOriginFilter.ALLOW_CREDENTIALS_PARAM, "false");
         return filterHolder;
     }
 
diff --git a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java
index 852af5cb972..8c58f9b9e04 100644
--- a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java
+++ b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java
@@ -30,6 +30,8 @@
 import org.apache.storm.generated.TopologyStats;
 import org.apache.storm.utils.Time;
 import net.minidev.json.JSONValue;
+import org.eclipse.jetty.ee10.servlet.FilterHolder;
+import org.eclipse.jetty.ee10.servlets.CrossOriginFilter;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -665,4 +667,15 @@ public void testGetJsonResponseHeadersInvalidCallbackFallsBackToJsonContentType(
         assertEquals("application/json;charset=utf-8", headers.get("Content-Type"));
         assertEquals("nosniff", headers.get("X-Content-Type-Options"));
     }
-}
\ No newline at end of file
+
+    @Test
+    public void testCorsFilterHandleSetsExplicitInitParameters() {
+        FilterHolder filterHolder = UIHelpers.corsFilterHandle();
+        assertEquals("*", filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM));
+        assertEquals("GET, POST, PUT", filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_METHODS_PARAM));
+        assertEquals("X-Requested-With, X-Requested-By, Access-Control-Allow-Origin,"
+                + " Content-Type, Content-Length, Accept, Origin",
+                filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_HEADERS_PARAM));
+        assertEquals("false", filterHolder.getInitParameter(CrossOriginFilter.ALLOW_CREDENTIALS_PARAM));
+    }
+}