diff --git a/src/index.js b/src/index.js
index 25f8756..7b2cb01 100644
--- a/src/index.js
+++ b/src/index.js
@@ -36,10 +36,12 @@ var constants = require('./constants.js')
 module.exports = function (options) {
   assert.object(options, 'options')
   assert.optionalArray(options.origins, 'options.origins')
-  options.origins.forEach(function (o) {
-    assert.ok(typeof o === 'string' || o instanceof RegExp, o +
+  if (options.origins) {
+    options.origins.forEach(function (o) {
+      assert.ok(typeof o === 'string' || o instanceof RegExp, o +
                 ' is not a valid origin')
-  })
+    })
+  }
   assert.optionalBool(options.credentials, 'options.credentials')
   assert.optionalArrayOfString(options.allowHeaders, 'options.allowHeaders')
   assert.optionalArrayOfString(options.exposeHeaders,
diff --git a/test/cors.actual.spec.js b/test/cors.actual.spec.js
index 21e5f3a..dee993b 100644
--- a/test/cors.actual.spec.js
+++ b/test/cors.actual.spec.js
@@ -94,4 +94,10 @@ describe('CORS: simple / actual requests', function () {
         .expect(200)
         .end(done)
   })
+
+  it('Does not throw if "origins" option left undefined', function () {
+    should.doesNotThrow(function createServer () {
+      test.corsServer({})
+    })
+  })
 })