diff --git a/src/main.rs b/src/main.rs
index ffd28564..081997dc 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -250,7 +250,8 @@ fn launch_rocket() {
     let rocket = rocket
         .manage(db::init_pool())
         .manage(api::start_notification_server())
-        .attach(util::AppHeaders());
+        .attach(util::AppHeaders())
+        .attach(util::CORS());
 
     // Launch and print error if there is one
     // The launch will restore the original logging level
diff --git a/src/util.rs b/src/util.rs
index c9815f15..a3548fcb 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -4,6 +4,8 @@
 use rocket::fairing::{Fairing, Info, Kind};
 use rocket::response::{self, Responder};
 use rocket::{Request, Response};
+use rocket::http::{Header, HeaderMap, ContentType, Method, Status};
+use std::io::Cursor;
 
 pub struct AppHeaders();
 
@@ -31,6 +33,51 @@ impl Fairing for AppHeaders {
     }
 }
 
+pub struct CORS();
+
+impl CORS {
+    fn get_header(headers: &HeaderMap, name: &str) -> String {
+        match headers.get_one(name) {
+            Some(h) => h.to_string(),
+            _ => "".to_string(),
+        }
+    }
+}
+
+impl Fairing for CORS {
+    fn info(&self) -> Info {
+        Info {
+            name: "Add CORS headers to requests",
+            kind: Kind::Response
+        }
+    }
+
+    fn on_response(&self, request: &Request, response: &mut Response) {
+        let req_headers = request.headers();
+
+        // We need to explicitly get the Origin header for Access-Control-Allow-Origin
+        let req_allow_origin = CORS::get_header(&req_headers, "Origin");
+
+        let req_allow_headers = CORS::get_header(&req_headers, "Access-Control-Request-Headers");
+
+        let req_allow_methods =CORS::get_header(&req_headers,"Access-Control-Request-Methods");
+
+        if request.method() == Method::Options || response.content_type() == Some(ContentType::JSON) {
+            // Requests with credentials need explicit values since they do not allow wildcards.
+            response.set_header(Header::new("Access-Control-Allow-Origin", req_allow_origin));
+            response.set_header(Header::new("Access-Control-Allow-Methods", req_allow_methods));
+            response.set_header(Header::new("Access-Control-Allow-Headers", req_allow_headers));
+            response.set_header(Header::new("Access-Control-Allow-Credentials", "true"));
+        }
+
+        if request.method() == Method::Options {
+            response.set_status(Status::Ok);
+            response.set_header(ContentType::Plain);
+            response.set_sized_body(Cursor::new(""));
+        }
+    }
+}
+
 pub struct Cached<R>(R, &'static str);
 
 impl<R> Cached<R> {