diff --git a/buffit/worker.js b/buffit/worker.js
index c856be6..7cb82fa 100644
--- a/buffit/worker.js
+++ b/buffit/worker.js
@@ -31,8 +31,8 @@ const UPSTREAM = {
 function corsHeaders(origin) {
   return {
     'Access-Control-Allow-Origin': origin === ALLOWED_ORIGIN ? origin : '',
-    'Access-Control-Allow-Methods': 'POST, OPTIONS',
-    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, X-Refresh-Token, X-New-Access-Token, X-New-Refresh-Token',
     'Access-Control-Max-Age': '86400',
   };
 }