diff --git a/ExtractIsdocFunction.cs b/ExtractIsdocFunction.cs
index 340a60a..aa76b68 100644
--- a/ExtractIsdocFunction.cs
+++ b/ExtractIsdocFunction.cs
@@ -1,4 +1,5 @@
 using System.Net;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.WebUtilities;
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Http;
@@ -15,8 +16,15 @@ public sealed class ExtractIsdocFunction(IsdocAttachmentExtractor extractor, ILo
 
     [Function(nameof(ExtractIsdocFunction))]
     public async Task<HttpResponseData> Run(
-        [HttpTrigger(AuthorizationLevel.Function, "post", Route = "extract-isdoc")] HttpRequestData request)
+        [HttpTrigger(AuthorizationLevel.Function, "post", "options", Route = "extract-isdoc")] HttpRequestData request)
     {
+        if (HttpMethods.IsOptions(request.Method))
+        {
+            var optionsResponse = request.CreateResponse(HttpStatusCode.NoContent);
+            AddCorsHeaders(optionsResponse);
+            return optionsResponse;
+        }
+
         byte[] pdfContent;
 
         try
@@ -40,6 +48,7 @@ public async Task<HttpResponseData> Run(
 
             var response = request.CreateResponse(HttpStatusCode.OK);
             response.Headers.Add("Content-Type", "application/xml; charset=utf-8");
+            AddCorsHeaders(response);
             await response.WriteStringAsync(xml);
             return response;
         }
@@ -112,7 +121,15 @@ private static async Task<HttpResponseData> CreateTextResponseAsync(
         string message)
     {
         var response = request.CreateResponse(statusCode);
+        AddCorsHeaders(response);
         await response.WriteStringAsync(message);
         return response;
     }
+
+    private static void AddCorsHeaders(HttpResponseData response)
+    {
+        response.Headers.Add("Access-Control-Allow-Origin", "*");
+        response.Headers.Add("Access-Control-Allow-Methods", "POST, OPTIONS");
+        response.Headers.Add("Access-Control-Allow-Headers", "Content-Type, Authorization, x-functions-key");
+    }
 }
diff --git a/tests/MKTestAzureFunction.Tests/ExtractIsdocFunctionTests.cs b/tests/MKTestAzureFunction.Tests/ExtractIsdocFunctionTests.cs
new file mode 100644
index 0000000..aad038e
--- /dev/null
+++ b/tests/MKTestAzureFunction.Tests/ExtractIsdocFunctionTests.cs
@@ -0,0 +1,23 @@
+using System.Reflection;
+using Microsoft.Azure.Functions.Worker;
+using MKTestAzureFunction;
+
+namespace MKTestAzureFunction.Tests;
+
+public class ExtractIsdocFunctionTests
+{
+    [Fact]
+    public void Run_HttpTrigger_ContainsOptionsMethodForCorsPreflight()
+    {
+        var runMethod = typeof(ExtractIsdocFunction).GetMethod(nameof(ExtractIsdocFunction.Run));
+
+        Assert.NotNull(runMethod);
+
+        var requestParameter = runMethod!.GetParameters().Single();
+        var triggerAttribute = requestParameter.GetCustomAttribute<HttpTriggerAttribute>();
+
+        Assert.NotNull(triggerAttribute);
+        Assert.NotNull(triggerAttribute!.Methods);
+        Assert.Contains("options", triggerAttribute.Methods, StringComparer.OrdinalIgnoreCase);
+    }
+}