diff --git a/gitiles-servlet/src/main/java/com/google/gitiles/BaseServlet.java b/gitiles-servlet/src/main/java/com/google/gitiles/BaseServlet.java
index 3e0e3bb..4190710 100644
--- a/gitiles-servlet/src/main/java/com/google/gitiles/BaseServlet.java
+++ b/gitiles-servlet/src/main/java/com/google/gitiles/BaseServlet.java
@@ -359,6 +359,9 @@
 
       if (!Strings.isNullOrEmpty(origin) && allowOriginPattern.matcher(origin).matches()) {
         res.setHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, origin);
+        res.setHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_HEADERS, "X-Requested-With");
+        res.setHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
+        res.setHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_METHODS, "GET");
       }
     } else {
       res.setHeader(HttpHeaders.ACCESS_CONTROL_ALLOW_ORIGIN, "*");