diff --git a/backend/Controllers/DispenserController.cs b/backend/Controllers/DispenserController.cs
index 48bc2fb..d9ed3db 100644
--- a/backend/Controllers/DispenserController.cs
+++ b/backend/Controllers/DispenserController.cs
@@ -2,6 +2,7 @@ using Microsoft.AspNetCore.Mvc;
 using MQTTnet;
 using backend.Application;
 using backend.Models;
+using backend.Middleware;
 
 namespace backend.Controllers;
 
@@ -9,8 +10,19 @@ namespace backend.Controllers;
 public class DispenserController : ControllerBase
 {
     [HttpPost("Dispense")]
-    public void Dispense()
+	[MiddlewareFilter(typeof(AuthenticationMiddlewareBuilder))]
+    public IActionResult Dispense()
     {
+		var user = ApplicationState.DbContext!.Users.FirstOrDefault(user => user.SessionToken == Request.Cookies["session"]!.ToString());
+		if (user == null) {
+			return BadRequest("Invalid session token");
+		}
+		if (user.Dispenses == 0) {
+			Console.WriteLine("Poorfag");
+			return BadRequest("Not enough dispenses on account");
+		}
+		
+		user.Dispenses--;
 		Console.WriteLine("Dispensing..");
 
 		var message = new MqttApplicationMessageBuilder()
@@ -22,5 +34,6 @@ public class DispenserController : ControllerBase
 		ApplicationState.DbContext!.SaveChanges();
 
 		ApplicationState.MqttClient!.PublishAsync(message, CancellationToken.None);
+		return Ok();
     }
 }
diff --git a/backend/Controllers/UserController.cs b/backend/Controllers/UserController.cs
index 1f8cc19..c1670d9 100644
--- a/backend/Controllers/UserController.cs
+++ b/backend/Controllers/UserController.cs
@@ -5,6 +5,7 @@ using System.Text.Json.Nodes;
 using Microsoft.AspNetCore.Identity;
 using System.Web;
 using backend.Middleware;
+using backend.Migrations;
 
 namespace backend.Controllers;
 
@@ -121,6 +122,7 @@ public class UserController : ControllerBase
 			username = user.Username,
 			touchCode = user.TouchCode,
 			isParent = user.IsParent,
+			dispenses = user.Dispenses,
 		};
 
 		return new JsonResult(data);
@@ -133,7 +135,7 @@ public class UserController : ControllerBase
 		var users = ApplicationState.DbContext!.Users
 			.Where(user => !user.IsParent)
 			.Select(user => new {
-				username => user.Username,
+				username = user.Username,
 				dispenses = user.Dispenses,
 			});
 
diff --git a/backend/Migrations/20231219115854_dispenses.Designer.cs b/backend/Migrations/20231219115854_dispenses.Designer.cs
new file mode 100644
index 0000000..344ca24
--- /dev/null
+++ b/backend/Migrations/20231219115854_dispenses.Designer.cs
@@ -0,0 +1,70 @@
+// <auto-generated />
+using System;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace backend.Migrations
+{
+    [DbContext(typeof(DispenserContext))]
+    [Migration("20231219115854_dispenses")]
+    partial class dispenses
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "8.0.0");
+
+            modelBuilder.Entity("backend.Models.DispenserLog", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("INTEGER");
+
+                    b.Property<DateTime>("Timestamp")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("DispenserLogs");
+                });
+
+            modelBuilder.Entity("backend.Models.User", b =>
+                {
+                    b.Property<int>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Dispenses")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<bool>("IsParent")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Password")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("SessionToken")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("TouchCode")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.ToTable("Users");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
diff --git a/backend/Migrations/20231219115854_dispenses.cs b/backend/Migrations/20231219115854_dispenses.cs
new file mode 100644
index 0000000..c0e5548
--- /dev/null
+++ b/backend/Migrations/20231219115854_dispenses.cs
@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace backend.Migrations
+{
+    /// <inheritdoc />
+    public partial class dispenses : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<int>(
+                name: "Dispenses",
+                table: "Users",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: 0);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "Dispenses",
+                table: "Users");
+        }
+    }
+}
diff --git a/backend/Migrations/DispenserContextModelSnapshot.cs b/backend/Migrations/DispenserContextModelSnapshot.cs
index a260f48..4cbede7 100644
--- a/backend/Migrations/DispenserContextModelSnapshot.cs
+++ b/backend/Migrations/DispenserContextModelSnapshot.cs
@@ -36,6 +36,9 @@ namespace backend.Migrations
                         .ValueGeneratedOnAdd()
                         .HasColumnType("INTEGER");
 
+                    b.Property<int>("Dispenses")
+                        .HasColumnType("INTEGER");
+
                     b.Property<bool>("IsParent")
                         .HasColumnType("INTEGER");
 
diff --git a/backend/Models/User.cs b/backend/Models/User.cs
index 1d6cef9..a361a29 100644
--- a/backend/Models/User.cs
+++ b/backend/Models/User.cs
@@ -14,4 +14,5 @@ public class User
     public string TouchCode { get; set; }
 	public string? SessionToken { get; set; }
 	public bool IsParent { get; set; }
+	public int Dispenses { get; set; }
 }
diff --git a/backend/Program.cs b/backend/Program.cs
index c88ca0e..6478baa 100644
--- a/backend/Program.cs
+++ b/backend/Program.cs
@@ -21,6 +21,7 @@ if (app.Environment.IsDevelopment())
 }
 
 app.UseCors(builder => {
+	builder.AllowAnyHeader();
 	builder.WithOrigins("http://localhost:5173");
 	builder.AllowCredentials();
 });
diff --git a/frontend/src/views/HomeView.vue b/frontend/src/views/HomeView.vue
index 34866b9..55f6909 100644
--- a/frontend/src/views/HomeView.vue
+++ b/frontend/src/views/HomeView.vue
@@ -6,6 +6,7 @@ const userStore = useStore("userStore");
 
 async function dispense() {
 	await request("POST", "/dispense");
+	userStore.state.userInfo.dispenses--;
 }
 </script>
 
@@ -14,7 +15,9 @@ async function dispense() {
 		<template v-if="userStore.state.userInfo">
 			<h2>Welcome back, {{ userStore.state.userInfo.username }}</h2>
 			<br>
-			<button @click="dispense">Dispense the m&m</button>
+			<h3>You have {{ userStore.state.userInfo.dispenses }} dispenses remaining</h3>
+			<br>
+			<button @click="dispense" :disabled="userStore.state.userInfo.dispenses === 0">Dispense the m&m</button>
 			<br><br>
 			<h3>Your touch code is: {{ userStore.state.userInfo.touchCode }}</h3>
 			<p>Use this code to login on the dispenser</p>