diff --git a/core/che-core-api-core/src/main/java/org/eclipse/che/api/core/cors/CheWsAgentCorsAllowedOriginsProvider.java b/core/che-core-api-core/src/main/java/org/eclipse/che/api/core/cors/CheWsAgentCorsAllowedOriginsProvider.java
deleted file mode 100644
index 4b3a9b6a9d..0000000000
--- a/core/che-core-api-core/src/main/java/org/eclipse/che/api/core/cors/CheWsAgentCorsAllowedOriginsProvider.java
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * Copyright (c) 2012-2018 Red Hat, Inc.
- * This program and the accompanying materials are made
- * available under the terms of the Eclipse Public License 2.0
- * which is available at https://www.eclipse.org/legal/epl-2.0/
- *
- * SPDX-License-Identifier: EPL-2.0
- *
- * Contributors:
- *   Red Hat, Inc. - initial API and implementation
- */
-package org.eclipse.che.api.core.cors;
-
-import com.google.inject.Inject;
-import com.google.inject.Provider;
-import javax.inject.Named;
-import javax.ws.rs.core.UriBuilder;
-import org.eclipse.che.commons.annotation.Nullable;
-
-/**
- * Provider of "cors.allowed.origins" setting for CORS Filter of WS Agent. Provides the value of WS
- * Master domain, by inferring it from "che.api" property
- */
-public class CheWsAgentCorsAllowedOriginsProvider implements Provider<String> {
-
-  private final String allowedOrigins;
-
-  @Inject
-  public CheWsAgentCorsAllowedOriginsProvider(
-      @Named("che.api.external") String cheApi,
-      @Nullable @Named("che.wsagent.cors.allowed_origins") String allowedOrigins) {
-    if (allowedOrigins == null) {
-      this.allowedOrigins = UriBuilder.fromUri(cheApi).replacePath(null).build().toString();
-    } else {
-      this.allowedOrigins = allowedOrigins;
-    }
-  }
-
-  @Override
-  public String get() {
-    return allowedOrigins;
-  }
-}
diff --git a/wsagent/che-wsagent-core/pom.xml b/wsagent/che-wsagent-core/pom.xml
index c5f2aeabb3..92eb6f39c1 100644
--- a/wsagent/che-wsagent-core/pom.xml
+++ b/wsagent/che-wsagent-core/pom.xml
@@ -76,6 +76,10 @@
             <groupId>org.eclipse.che.core</groupId>
             <artifactId>che-core-api-languageserver</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.eclipse.che.core</groupId>
+            <artifactId>che-core-api-model</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.eclipse.che.core</groupId>
             <artifactId>che-core-api-oauth</artifactId>
@@ -88,10 +92,18 @@
             <groupId>org.eclipse.che.core</groupId>
             <artifactId>che-core-api-project-shared</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.eclipse.che.core</groupId>
+            <artifactId>che-core-api-workspace</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.eclipse.che.core</groupId>
             <artifactId>che-core-api-workspace-shared</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.eclipse.che.core</groupId>
+            <artifactId>che-core-commons-annotations</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.eclipse.che.core</groupId>
             <artifactId>che-core-commons-auth</artifactId>
diff --git a/core/che-core-api-core/src/main/java/org/eclipse/che/api/core/cors/CheWsAgentCorsAllowCredentialsProvider.java b/wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentCorsAllowCredentialsProvider.java
similarity index 96%
rename from core/che-core-api-core/src/main/java/org/eclipse/che/api/core/cors/CheWsAgentCorsAllowCredentialsProvider.java
rename to wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentCorsAllowCredentialsProvider.java
index e76ae3f21e..fbd061410d 100644
--- a/core/che-core-api-core/src/main/java/org/eclipse/che/api/core/cors/CheWsAgentCorsAllowCredentialsProvider.java
+++ b/wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentCorsAllowCredentialsProvider.java
@@ -9,7 +9,7 @@
  * Contributors:
  *   Red Hat, Inc. - initial API and implementation
  */
-package org.eclipse.che.api.core.cors;
+package org.eclipse.che.wsagent.server;
 
 import com.google.inject.Inject;
 import com.google.inject.Provider;
diff --git a/wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentCorsAllowedOriginsProvider.java b/wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentCorsAllowedOriginsProvider.java
new file mode 100644
index 0000000000..d3b3e13296
--- /dev/null
+++ b/wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentCorsAllowedOriginsProvider.java
@@ -0,0 +1,100 @@
+/*
+ * Copyright (c) 2012-2018 Red Hat, Inc.
+ * This program and the accompanying materials are made
+ * available under the terms of the Eclipse Public License 2.0
+ * which is available at https://www.eclipse.org/legal/epl-2.0/
+ *
+ * SPDX-License-Identifier: EPL-2.0
+ *
+ * Contributors:
+ *   Red Hat, Inc. - initial API and implementation
+ */
+package org.eclipse.che.wsagent.server;
+
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+import java.io.IOException;
+import javax.inject.Named;
+import javax.ws.rs.core.UriBuilder;
+import org.eclipse.che.api.core.ApiException;
+import org.eclipse.che.api.core.model.workspace.runtime.Machine;
+import org.eclipse.che.api.core.model.workspace.runtime.Server;
+import org.eclipse.che.api.core.rest.HttpJsonRequestFactory;
+import org.eclipse.che.api.workspace.server.WorkspaceService;
+import org.eclipse.che.api.workspace.shared.dto.WorkspaceDto;
+import org.eclipse.che.commons.annotation.Nullable;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Provider of "cors.allowed.origins" setting for CORS Filter of WS Agent. Provides the value such
+ * algorithm:
+ *
+ * <ul>
+ *   <li>If set che.wsagent.cors.allowed_origins
+ *   <li>Server with "ide" attribute in workspace config
+ *   <li>Server from url of "ide" link in workspace config
+ *   <li>che.api
+ * </ul>
+ */
+public class CheWsAgentCorsAllowedOriginsProvider implements Provider<String> {
+
+  private static final Logger LOG =
+      LoggerFactory.getLogger(CheWsAgentCorsAllowedOriginsProvider.class);
+
+  private final String allowedOrigins;
+
+  @Inject
+  public CheWsAgentCorsAllowedOriginsProvider(
+      @Named("che.api") String apiEndpoint,
+      @Nullable @Named("che.wsagent.cors.allowed_origins") String allowedOrigins,
+      HttpJsonRequestFactory httpJsonRequestFactory)
+      throws ApiException, IOException {
+    this.allowedOrigins = evaluateOrigins(apiEndpoint, allowedOrigins, httpJsonRequestFactory);
+  }
+
+  @Override
+  public String get() {
+    LOG.debug("allowedOrigins {} ", allowedOrigins);
+    return allowedOrigins;
+  }
+
+  private String evaluateOrigins(
+      String apiEndpoint, String allowedOrigins, HttpJsonRequestFactory httpJsonRequestFactory)
+      throws ApiException, IOException {
+    if (allowedOrigins != null) {
+      return allowedOrigins;
+    }
+
+    final UriBuilder builder =
+        UriBuilder.fromUri(apiEndpoint)
+            .path(WorkspaceService.class)
+            .path(WorkspaceService.class, "getByKey")
+            .queryParam("includeInternalServers", "true");
+
+    String href = builder.build(System.getenv("CHE_WORKSPACE_ID")).toString();
+    WorkspaceDto workspaceDto =
+        httpJsonRequestFactory.fromUrl(href).useGetMethod().request().asDto(WorkspaceDto.class);
+
+    String ideUrl = getIdeUrl(workspaceDto);
+    if (ideUrl != null) {
+      return UriBuilder.fromUri(ideUrl).replacePath(null).build().toString();
+    }
+    return UriBuilder.fromUri(workspaceDto.getLinks().getOrDefault("ide", apiEndpoint))
+        .replacePath(null)
+        .build()
+        .toString();
+  }
+
+  private String getIdeUrl(WorkspaceDto workspaceDto) {
+    for (Machine machine : workspaceDto.getRuntime().getMachines().values()) {
+      for (Server server : machine.getServers().values()) {
+        if ("ide".equals(server.getAttributes().get("type"))) {
+          LOG.debug("Found ide server {}", server);
+          return server.getUrl();
+        }
+      }
+    }
+    return null;
+  }
+}
diff --git a/wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentModule.java b/wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentModule.java
index f2f0a72fda..5368b6031b 100644
--- a/wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentModule.java
+++ b/wsagent/che-wsagent-core/src/main/java/org/eclipse/che/wsagent/server/CheWsAgentModule.java
@@ -16,8 +16,6 @@ import com.google.inject.name.Names;
 import java.net.URI;
 import org.eclipse.che.MachineTokenProvider;
 import org.eclipse.che.UriApiEndpointProvider;
-import org.eclipse.che.api.core.cors.CheWsAgentCorsAllowCredentialsProvider;
-import org.eclipse.che.api.core.cors.CheWsAgentCorsAllowedOriginsProvider;
 import org.eclipse.che.inject.DynaModule;
 import org.eclipse.che.wsagent.server.appstate.AppStateService;