diff --git a/app/controllers/api/application_controller.rb b/app/controllers/api/application_controller.rb
index 18cda2d..5bc60e0 100644
--- a/app/controllers/api/application_controller.rb
+++ b/app/controllers/api/application_controller.rb
@@ -5,7 +5,9 @@ class Api::ApplicationController < ApplicationController
   before_filter :cor_filter
 
   def cor_filter
-    headers['Access-Control-Allow-Origin'] = request.headers['Origin']
+    headers['Access-Control-Allow-Origin'] = request.headers['Origin'] ?
+      request.headers['Origin'] :
+      ''
     headers['Access-Control-Allow-Credentials'] = 'true'
   end
 
diff --git a/spec/integration/api/cross_origin_request_spec.rb b/spec/integration/api/cross_origin_request_spec.rb
index c11ffae..cbb552b 100644
--- a/spec/integration/api/cross_origin_request_spec.rb
+++ b/spec/integration/api/cross_origin_request_spec.rb
@@ -40,4 +40,11 @@ feature 'API cross origin request' do
     response.headers['Access-Control-Allow-Origin'].should == origin
     response.headers['Access-Control-Allow-Credentials'].should == 'true'
   end
+
+  scenario 'request without origin' do
+    # FIXME: replace with a more stable/generic action
+    get api_playlists_path(:format => :json)
+
+    response.headers['Access-Control-Allow-Origin'].should == ''
+  end
 end