diff --git a/functions/grapher/_middleware.ts b/functions/grapher/_middleware.ts
new file mode 100644
index 00000000000..656c37cd266
--- /dev/null
+++ b/functions/grapher/_middleware.ts
@@ -0,0 +1,20 @@
+// Respond to OPTIONS method
+export const onRequestOptions: PagesFunction = async () => {
+    return new Response(null, {
+        status: 204,
+        headers: {
+            "Access-Control-Allow-Origin": "*",
+            "Access-Control-Allow-Headers": "*",
+            "Access-Control-Allow-Methods": "GET, OPTIONS",
+            "Access-Control-Max-Age": "86400",
+        },
+    })
+}
+
+// Set CORS to all /api responses
+export const onRequest: PagesFunction = async (context) => {
+    const response = await context.next()
+    response.headers.set("Access-Control-Allow-Origin", "*")
+    response.headers.set("Access-Control-Max-Age", "86400")
+    return response
+}