diff --git a/xiangqi_bot/server.py b/xiangqi_bot/server.py
index 8d6ae6f..e05e811 100644
--- a/xiangqi_bot/server.py
+++ b/xiangqi_bot/server.py
@@ -58,6 +58,19 @@ class Service:
                 'score': score, 'note': None}
 
 
+@web.middleware
+async def cors_middleware(request, handler):
+    """油猴脚本从 https 页面跨域调用本服务: 处理 OPTIONS 预检并补 CORS 头。"""
+    if request.method == 'OPTIONS':
+        resp = web.Response(status=204)
+    else:
+        resp = await handler(request)
+    resp.headers['Access-Control-Allow-Origin'] = '*'
+    resp.headers['Access-Control-Allow-Methods'] = 'GET, POST, OPTIONS'
+    resp.headers['Access-Control-Allow-Headers'] = 'Content-Type'
+    return resp
+
+
 def make_app(args):
     svc = Service(args)
 
@@ -88,7 +101,7 @@ def make_app(args):
         except Exception as e:
             return web.json_response({'ok': False, 'error': str(e)}, status=500)
 
-    app = web.Application()
+    app = web.Application(middlewares=[cors_middleware])
     app.router.add_get('/health', health)
     app.router.add_post('/bestmove', bestmove)
     app.on_startup.append(svc.startup)