diff --git a/crates/rpc/rpc-builder/src/cors.rs b/crates/rpc/rpc-builder/src/cors.rs
index c68cf84942..ee0ceb4266 100644
--- a/crates/rpc/rpc-builder/src/cors.rs
+++ b/crates/rpc/rpc-builder/src/cors.rs
@@ -27,7 +27,7 @@ pub(crate) fn create_cors_layer(http_cors_domains: &str) -> Result<CorsLayer, Co
             .allow_origin(Any)
             .allow_headers(Any),
         _ => {
-            let iter = http_cors_domains.split(',');
+            let iter = http_cors_domains.split(',').map(str::trim);
             if iter.clone().any(|o| o == "*") {
                 return Err(CorsDomainError::WildCardNotAllowed {
                     input: http_cors_domains.to_string(),
@@ -51,3 +51,15 @@ pub(crate) fn create_cors_layer(http_cors_domains: &str) -> Result<CorsLayer, Co
     };
     Ok(cors)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_wildcard_with_spaces_rejected() {
+        // Wildcard with leading space should still be rejected
+        let result = create_cors_layer("http://example.com, *");
+        assert!(matches!(result, Err(CorsDomainError::WildCardNotAllowed { .. })));
+    }
+}