diff --git a/service.go b/service.go
index 6436ddd..0c88a69 100644
--- a/service.go
+++ b/service.go
@@ -20,10 +20,6 @@
 	docID := c.Param("doc_id")
 	textID := c.Param("text_id")
 
-	c.Header("Access-Control-Allow-Origin", "null")
-	c.Header("Access-Control-Allow-Credentials", "null")
-	c.Header("Vary", "Origin")
-
 	err := db.View(func(txn *badger.Txn) error {
 
 		item, err := txn.Get([]byte(corpusID + "/" + docID + "/" + textID))
@@ -82,11 +78,18 @@
 		korapServer = "https://korap.ids-mannheim.de"
 	}
 
+	r.Use(func() gin.HandlerFunc {
+		return func(c *gin.Context) {
+			h := c.Writer.Header()
+			h.Set("Access-Control-Allow-Origin", "null")
+			h.Set("Access-Control-Allow-Credentials", "null")
+			h.Set("Vary", "Origin")
+		}
+	}(),
+	)
+
 	//
 	r.GET("/", func(c *gin.Context) {
-		c.Header("Access-Control-Allow-Origin", "null")
-		c.Header("Access-Control-Allow-Credentials", "null")
-		c.Header("Vary", "Origin")
 		c.HTML(http.StatusOK, "main.html", gin.H{
 			"korapServer": korapServer,
 		})
diff --git a/service_test.go b/service_test.go
index 7304ae7..5efcd59 100644
--- a/service_test.go
+++ b/service_test.go
@@ -32,6 +32,9 @@
 
 	router.ServeHTTP(w, req)
 	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Equal(t, w.Header().Get("Access-Control-Allow-Origin"), "null")
+	assert.Equal(t, w.Header().Get("Access-Control-Allow-Credentials"), "null")
+	assert.Equal(t, w.Header().Get("Vary"), "Origin")
 	assert.Equal(t, "sueddeutsche,http://example.org", w.Body.String())
 
 	w = httptest.NewRecorder()
@@ -52,6 +55,9 @@
 	router.ServeHTTP(w, req)
 
 	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Equal(t, w.Header().Get("Access-Control-Allow-Origin"), "null")
+	assert.Equal(t, w.Header().Get("Access-Control-Allow-Credentials"), "null")
+	assert.Equal(t, w.Header().Get("Vary"), "Origin")
 	assert.Contains(t, w.Body.String(), "data-server=\"https://korap.ids-mannheim.de\"")
 	assert.Contains(t, w.Body.String(), "<title>External Provider</title>")