diff --git a/shared/src/poe.rs b/shared/src/poe.rs
index b718669..f8771fd 100644
--- a/shared/src/poe.rs
+++ b/shared/src/poe.rs
@@ -104,6 +104,12 @@ impl ClassSet {
     }
 }
 
+impl Default for ClassSet {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
 impl std::fmt::Debug for ClassSet {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         write!(f, "ClassSet(")?;
diff --git a/worker/src/consts.rs b/worker/src/consts.rs
index 1103927..743e90d 100644
--- a/worker/src/consts.rs
+++ b/worker/src/consts.rs
@@ -25,3 +25,5 @@ pub const OAUTH_SCOPE: &str = "account:profile";
 
 pub const CACHE_A_BIT: Duration = Duration::from_secs(21600); // 6 Hours
 pub const CACHE_FOREVER: Duration = Duration::from_secs(31536000);
+
+pub const CORS_POB_API: &[&str] = &["https://pob.cool"];
diff --git a/worker/src/lib.rs b/worker/src/lib.rs
index ec87aae..729eaeb 100644
--- a/worker/src/lib.rs
+++ b/worker/src/lib.rs
@@ -29,7 +29,7 @@ mod app_metadata {
 }
 
 use request_context::RequestContext;
-use utils::CacheControl;
+use utils::{CacheControl, RequestExt};
 
 pub use self::error::{Error, ErrorResponse, Result};
 pub use self::response::Response;
@@ -96,11 +96,31 @@ async fn cached(rctx: &mut RequestContext) -> Response {
         .tag("status", "miss")
         .tag("transaction", rctx.transaction());
 
-    let response = handle(rctx).await;
+    let response = cors(rctx).await;
 
     cache_entry.store(response).await
 }
 
+async fn cors(rctx: &mut RequestContext) -> Response {
+    let response = handle(rctx).await;
+
+    let matches = |allowed: &[&str]| {
+        let origin = rctx.header("Origin");
+        origin.filter(|origin| allowed.contains(&origin.as_str()))
+    };
+
+    use route::{Api::*, GetEndpoints::*, Route::*};
+    let origin = match rctx.route() {
+        Api(Get(PobPaste(_) | PobUserPaste(_, _))) => matches(consts::CORS_POB_API),
+        _ => None,
+    };
+
+    response.append_header(
+        "Access-Control-Allow-Origin",
+        origin.as_deref().unwrap_or(""),
+    )
+}
+
 #[tracing::instrument(skip_all)]
 async fn handle(rctx: &mut RequestContext) -> Response {
     let response = match rctx.route() {