diff --git a/src/main/java/ch/ethz/seb/sebserver/gui/RAPConfiguration.java b/src/main/java/ch/ethz/seb/sebserver/gui/RAPConfiguration.java
index 9550f29f..5dd022ca 100644
--- a/src/main/java/ch/ethz/seb/sebserver/gui/RAPConfiguration.java
+++ b/src/main/java/ch/ethz/seb/sebserver/gui/RAPConfiguration.java
@@ -136,10 +136,14 @@ public class RAPConfiguration implements ApplicationConfiguration {
         }
     }
 
+    // https://developer.chrome.com/blog/enabling-shared-array-buffer/#cross-origin-isolation
     public static final void setCORS(final HttpServletResponse resp) {
-        resp.addHeader("Access-Control-Allow-Origin", "*");
-        resp.setHeader("Access-Control-Allow-Methods", "GET");
-        resp.setHeader("Vary", "Origin");
+//        resp.addHeader("Access-Control-Allow-Origin", "*");
+//        resp.setHeader("Access-Control-Allow-Methods", "GET");
+//        resp.setHeader("Vary", "Origin");
+
+        resp.addHeader("Cross-Origin-Embedder-Policy", "require-corp");
+        resp.addHeader("Cross-Origin-Opener-Policy", "same-origin");
     }
 
     public static final class RAPSpringEntryPointFactory implements EntryPointFactory {
diff --git a/src/main/resources/config/application-gui.properties b/src/main/resources/config/application-gui.properties
index 25465c53..300bc489 100644
--- a/src/main/resources/config/application-gui.properties
+++ b/src/main/resources/config/application-gui.properties
@@ -38,7 +38,7 @@ sebserver.gui.webservice.edx-lms-enabled=true
 sebserver.gui.webservice.moodle-lms-enabled=true
 sebserver.gui.seb.client.config.download.filename=SEBServerSettings.seb
 sebserver.gui.seb.exam.config.download.filename=SEBExamSettings.seb
-sebserver.gui.proctoring.zoom.websdk.version=1.9.8
+sebserver.gui.proctoring.zoom.websdk.version=2.8.0
 sebserver.gui.filter.date.from.years=2
 
 # remote proctoring