diff --git a/tokenpluginfile.php b/tokenpluginfile.php
index 18d67af1ecf..1b25db9ac5a 100644
--- a/tokenpluginfile.php
+++ b/tokenpluginfile.php
@@ -33,6 +33,8 @@ require_once('config.php');
 
 // Allow CORS requests.
 header('Access-Control-Allow-Origin: *');
+header('Access-Control-Allow-Headers: range');
+header('Access-Control-Expose-Headers: Content-Range');
 
 $relativepath = get_file_argument();
 $token = optional_param('token', '', PARAM_ALPHANUM);
diff --git a/webservice/pluginfile.php b/webservice/pluginfile.php
index f90aaf5d866..902a68fbce7 100644
--- a/webservice/pluginfile.php
+++ b/webservice/pluginfile.php
@@ -40,6 +40,8 @@ require_once($CFG->dirroot . '/webservice/lib.php');
 
 // Allow CORS requests.
 header('Access-Control-Allow-Origin: *');
+header('Access-Control-Allow-Headers: range');
+header('Access-Control-Expose-Headers: Content-Range');
 
 // Authenticate the user.
 $token = required_param('token', PARAM_ALPHANUM);