diff --git a/index.js b/index.js
index dec2788..4df72da 100644
--- a/index.js
+++ b/index.js
@@ -133,9 +133,13 @@ function mountSwagger(loopbackApplication, swaggerApp, opts) {
 }
 
 function setupCors(swaggerApp, remotes) {
-  var corsOptions = remotes.options && remotes.options.cors ||
-  { origin: true, credentials: true };
+  var corsOptions = remotes.options && remotes.options.cors;
+  if (corsOptions === false)
+    return;
+
+  if (corsOptions === undefined) {
+    corsOptions = { origin: true, credentials: true };
+  }
 
-  // TODO(bajtos) Skip CORS when remotes.options.cors === false
   swaggerApp.use(cors(corsOptions));
 }
diff --git a/test/explorer.test.js b/test/explorer.test.js
index 5769c22..932629c 100644
--- a/test/explorer.test.js
+++ b/test/explorer.test.js
@@ -258,7 +258,7 @@ describe('explorer', function() {
 
     it('can be disabled by configuration', function(done) {
       var app = loopback();
-      app.set('remoting', { cors: { origin: false }});
+      app.set('remoting', { cors: false });
       configureRestApiAndExplorer(app, '/explorer');
 
       request(app)