diff --git a/app/port/controller/package/DownloadPackageVersionTar.ts b/app/port/controller/package/DownloadPackageVersionTar.ts
index 6295227f..123ad8ee 100644
--- a/app/port/controller/package/DownloadPackageVersionTar.ts
+++ b/app/port/controller/package/DownloadPackageVersionTar.ts
@@ -30,6 +30,8 @@ export class DownloadPackageVersionTarController extends AbstractController {
     method: HTTPMethodEnum.OPTIONS,
   })
   async downloadForOptions(@Context() ctx: EggContext) {
+    ctx.set('access-control-allow-origin', '*');
+    ctx.set('access-control-allow-methods', 'GET,HEAD');
     ctx.status = 204;
   }
 
diff --git a/test/port/controller/package/DownloadPackageVersionTarController.test.ts b/test/port/controller/package/DownloadPackageVersionTarController.test.ts
index 2715f114..bd1a9702 100644
--- a/test/port/controller/package/DownloadPackageVersionTarController.test.ts
+++ b/test/port/controller/package/DownloadPackageVersionTarController.test.ts
@@ -61,9 +61,13 @@ describe('test/port/controller/package/DownloadPackageVersionTarController.test.
       let res = await app.httpRequest()
         .options(`/${name}/-/testmodule-download-version-tar-1.0.0.tgz`);
       assert.equal(res.status, 204);
+      assert.equal(res.headers['access-control-allow-origin'], '*');
+      assert.equal(res.headers['access-control-allow-methods'], 'GET,HEAD');
       res = await app.httpRequest()
         .options(`/${scopedName}/-/testmodule-download-version-tar-1.0.0.tgz`);
       assert.equal(res.status, 204);
+      assert.equal(res.headers['access-control-allow-origin'], '*');
+      assert.equal(res.headers['access-control-allow-methods'], 'GET,HEAD');
     });
 
     if (process.env.CNPMCORE_NFS_TYPE !== 'oss') {