diff --git a/danmu_api/utils/http-util.js b/danmu_api/utils/http-util.js
index 873a5ae..edae845 100644
--- a/danmu_api/utils/http-util.js
+++ b/danmu_api/utils/http-util.js
@@ -300,7 +300,10 @@ export async function getPageTitle(url) {
 export function jsonResponse(data, status = 200) {
   return new Response(JSON.stringify(data), {
     status,
-    headers: { "Content-Type": "application/json" },
+    headers: { 
+      "Content-Type": "application/json",
+      "Access-Control-Allow-Origin": "*"
+    }
   });
 }
 
@@ -313,7 +316,10 @@ export function xmlResponse(data, status = 200) {
   // 直接返回 XML 字符串作为 Response 的 body
   return new Response(data, {
     status,
-    headers: { "Content-Type": "application/xml" },
+    headers: { 
+      "Content-Type": "application/xml",
+      "Access-Control-Allow-Origin": "*"
+    }
   });
 }
 
diff --git a/danmu_api/worker.js b/danmu_api/worker.js
index 4001883..9336599 100644
--- a/danmu_api/worker.js
+++ b/danmu_api/worker.js
@@ -53,8 +53,15 @@ async function handleRequest(req, env, deployPlatform, clientIp) {
     return handleHomepage();
   }
 
-  if (path === "/favicon.ico" || path === "/robots.txt") {
-    return new Response(null, { status: 204 });
+  if (path === "/favicon.ico" || path === "/robots.txt" || method === "OPTIONS") {
+    return new Response(null, {
+        status: 204,
+        headers: {
+            "Access-Control-Allow-Origin": "*",
+            "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
+            "Access-Control-Allow-Headers": "Content-Type, Authorization, User-Agent"
+        }
+    });
   }
 
   // --- 校验 token ---