diff --git a/src/app.js b/src/app.js
index f05661e578c2f864f6fcdc8b3e4477159dac98d7..960c7ffa63461574a6992b8571a945f8402ddcd7 100644
--- a/src/app.js
+++ b/src/app.js
@@ -59,9 +59,17 @@ const configureApp = app => {
   // Allow CORS from client if host / port is different
   if (config.has('pubsweet-client.host')) {
     const clientProtocol = config.get('pubsweet-client.protocol') || 'http'
-    const clientHost = config.get('pubsweet-client.host')
+    let clientHost = config.get('pubsweet-client.host')
     const clientPort = config.get('pubsweet-client.port')
 
+    // This is here because webpack dev server might need to be started with
+    // 0.0.0.0 instead of localhost, but the incoming request will still be
+    // eg. http://localhost:4000, not http://0.0.0.0:4000, which will make
+    // the CORS check fail
+    if (clientHost === '0.0.0.0' || clientHost === '127.0.0.1') {
+      clientHost = 'localhost'
+    }
+
     const clientUrl = `${clientProtocol}://${clientHost}${
       clientPort ? `:${clientPort}` : ''
     }`