diff --git a/command/agent/config.go b/command/agent/config.go
index 707cd43ade..84b74c23bf 100644
--- a/command/agent/config.go
+++ b/command/agent/config.go
@@ -310,6 +310,9 @@ type Config struct {
 	// send with the update check. This is used to deduplicate messages.
 	DisableAnonymousSignature bool `mapstructure:"disable_anonymous_signature"`
 
+	// HTTPAPIResponseHeaders are used to add HTTP header response fields to the HTTP API responses.
+	HTTPAPIResponseHeaders map[string]string `mapstructure:"http_api_response_headers"`
+
 	// AEInterval controls the anti-entropy interval. This is how often
 	// the agent attempts to reconcile it's local state with the server'
 	// representation of our state. Defaults to every 60s.
@@ -859,6 +862,15 @@ func MergeConfig(a, b *Config) *Config {
 		result.DisableAnonymousSignature = true
 	}
 
+	if len(b.HTTPAPIResponseHeaders) != 0 {
+		if result.HTTPAPIResponseHeaders == nil {
+			result.HTTPAPIResponseHeaders = make(map[string]string)
+		}
+		for field, value := range b.HTTPAPIResponseHeaders {
+			result.HTTPAPIResponseHeaders[field] = value
+		}
+	}
+
 	// Copy the start join addresses
 	result.StartJoin = make([]string, 0, len(a.StartJoin)+len(b.StartJoin))
 	result.StartJoin = append(result.StartJoin, a.StartJoin...)
diff --git a/command/agent/config_test.go b/command/agent/config_test.go
index 13e8634ce4..7ea685009f 100644
--- a/command/agent/config_test.go
+++ b/command/agent/config_test.go
@@ -589,6 +589,21 @@ func TestDecodeConfig(t *testing.T) {
 	if !config.DisableAnonymousSignature {
 		t.Fatalf("bad: %#v", config)
 	}
+
+	// HTTP API response header fields
+	input = `{"http_api_response_headers": {"Access-Control-Allow-Origin": "*", "X-XSS-Protection": "1; mode=block"}}`
+	config, err = DecodeConfig(bytes.NewReader([]byte(input)))
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
+	if config.HTTPAPIResponseHeaders["Access-Control-Allow-Origin"] != "*" {
+		t.Fatalf("bad: %#v", config)
+	}
+
+	if config.HTTPAPIResponseHeaders["X-XSS-Protection"] != "1; mode=block" {
+		t.Fatalf("bad: %#v", config)
+	}
 }
 
 func TestDecodeConfig_Services(t *testing.T) {
@@ -960,6 +975,9 @@ func TestMergeConfig(t *testing.T) {
 		StatsdAddr:                "127.0.0.1:7251",
 		DisableUpdateCheck:        true,
 		DisableAnonymousSignature: true,
+		HTTPAPIResponseHeaders: map[string]string{
+			"Access-Control-Allow-Origin": "*",
+		},
 	}
 
 	c := MergeConfig(a, b)
diff --git a/command/agent/http.go b/command/agent/http.go
index 8c174711bf..f9bc300784 100644
--- a/command/agent/http.go
+++ b/command/agent/http.go
@@ -231,6 +231,8 @@ func (s *HTTPServer) registerHandlers(enableDebug bool) {
 // wrap is used to wrap functions to make them more convenient
 func (s *HTTPServer) wrap(handler func(resp http.ResponseWriter, req *http.Request) (interface{}, error)) func(resp http.ResponseWriter, req *http.Request) {
 	f := func(resp http.ResponseWriter, req *http.Request) {
+		setHeaders(resp, s.agent.config.HTTPAPIResponseHeaders)
+
 		// Invoke the handler
 		start := time.Now()
 		defer func() {
@@ -336,6 +338,13 @@ func setMeta(resp http.ResponseWriter, m *structs.QueryMeta) {
 	setKnownLeader(resp, m.KnownLeader)
 }
 
+// setHeaders is used to set canonical response header fields
+func setHeaders(resp http.ResponseWriter, headers map[string]string) {
+	for field, value := range headers {
+		resp.Header().Set(http.CanonicalHeaderKey(field), value)
+	}
+}
+
 // parseWait is used to parse the ?wait and ?index query params
 // Returns true on error
 func parseWait(resp http.ResponseWriter, req *http.Request, b *structs.QueryOptions) bool {
diff --git a/command/agent/http_test.go b/command/agent/http_test.go
index a1570a9db0..c5a9d83af8 100644
--- a/command/agent/http_test.go
+++ b/command/agent/http_test.go
@@ -102,6 +102,37 @@ func TestSetMeta(t *testing.T) {
 	}
 }
 
+func TestHTTPAPIResponseHeaders(t *testing.T) {
+	dir, srv := makeHTTPServer(t)
+	srv.agent.config.HTTPAPIResponseHeaders = map[string]string{
+		"Access-Control-Allow-Origin": "*",
+		"X-XSS-Protection":            "1; mode=block",
+	}
+
+	defer os.RemoveAll(dir)
+	defer srv.Shutdown()
+	defer srv.agent.Shutdown()
+
+	resp := httptest.NewRecorder()
+
+	handler := func(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
+		return nil, nil
+	}
+
+	req, _ := http.NewRequest("GET", "/v1/agent/self", nil)
+	srv.wrap(handler)(resp, req)
+
+	origin := resp.Header().Get("Access-Control-Allow-Origin")
+	if origin != "*" {
+		t.Fatalf("bad Access-Control-Allow-Origin: expected %q, got %q", "*", origin)
+	}
+
+	xss := resp.Header().Get("X-XSS-Protection")
+	if xss != "1; mode=block" {
+		t.Fatalf("bad X-XSS-Protection header: expected %q, got %q", "1; mode=block", xss)
+	}
+}
+
 func TestContentTypeIsJSON(t *testing.T) {
 	dir, srv := makeHTTPServer(t)
 
diff --git a/ui/development_config.json b/ui/development_config.json
index 940eb7d891..3f7ca6b240 100644
--- a/ui/development_config.json
+++ b/ui/development_config.json
@@ -5,5 +5,8 @@
   "bootstrap": true,
   "server": true,
   "acl_datacenter": "dc1",
-  "acl_master_token": "dev"
+  "acl_master_token": "dev",
+  "http_api_response_headers": {
+    "Access-Control-Allow-Origin": "*"
+  }
 }
diff --git a/website/source/docs/agent/options.html.markdown b/website/source/docs/agent/options.html.markdown
index 980d3cd905..435710f150 100644
--- a/website/source/docs/agent/options.html.markdown
+++ b/website/source/docs/agent/options.html.markdown
@@ -172,7 +172,7 @@ being configured using a configuration management system.
 
 The configuration files are JSON formatted, making them easily readable
 and editable by both humans and computers. The configuration is formatted
-at a single JSON object with configuration within it.
+as a single JSON object with configuration within it.
 
 Configuration files are used for more than just setting up the agent,
 they are also used to provide check and service definitions. These are used
@@ -327,6 +327,18 @@ definitions support being updated during a reload.
   The key is used with the certificate to verify the agents authenticity.
   Must be provided along with the `cert_file`.
 
+* `http_api_response_headers` - This object allows adding HTTP header response fields to
+  the HTTP API responses. For example, the following config can be used to enable CORS on
+  the HTTP API endpoints:
+
+    ```javascript
+      {
+        "http_api_response_headers": {
+            "Access-Control-Allow-Origin": "*"
+        }
+      }
+    ```
+
 * `leave_on_terminate` - If enabled, when the agent receives a TERM signal,
   it will send a Leave message to the rest of the cluster and gracefully
   leave. Defaults to false.