diff --git a/src/web/mod.rs b/src/web/mod.rs
index 857c8f5..1989c96 100644
--- a/src/web/mod.rs
+++ b/src/web/mod.rs
@@ -3,8 +3,9 @@ mod nip11;
 
 use crate::error::Error;
 use crate::ip::HashedPeer;
+use http::Method;
 use http_body_util::combinators::BoxBody;
-use http_body_util::{BodyExt, Full};
+use http_body_util::{BodyExt, Empty, Full};
 use hyper::body::{Bytes, Incoming};
 use hyper::{Request, Response, StatusCode};
 
@@ -12,6 +13,22 @@ pub async fn serve_http(
     peer: HashedPeer,
     request: Request<Incoming>,
 ) -> Result<Response<BoxBody<Bytes, Error>>, Error> {
+    // Handle server-wide OPTIONS requests
+    let p = request.uri().path();
+    if p == "*" && request.method() == Method::OPTIONS {
+        let response = Response::builder()
+            .header("Access-Control-Allow-Origin", "*")
+            .header("Access-Control-Allow-Headers", "Authorization, *")
+            .header(
+                "Access-Control-Allow-Methods",
+                "OPTIONS, GET, HEAD, PUT, DELETE",
+            )
+            .header("Allow", "OPTIONS, GET, HEAD, PUT, DELETE")
+            .status(StatusCode::OK)
+            .body(Empty::new().map_err(|e| e.into()).boxed())?;
+        return Ok(response);
+    }
+
     // check for Accept header of application/nostr+json
     if let Some(accept) = request.headers().get("Accept") {
         if let Ok(s) = accept.to_str() {