diff --git a/lib/filelib.php b/lib/filelib.php
index 7fcd08d445f..488bae2b1bb 100644
--- a/lib/filelib.php
+++ b/lib/filelib.php
@@ -1953,6 +1953,13 @@ function file_mimetype_in_typegroup($mimetype, $groups) {
  */
 function send_file_not_found() {
     global $CFG, $COURSE;
+
+    // Allow cross-origin requests only for Web Services.
+    // This allow to receive requests done by Web Workers or webapps in different domains.
+    if (WS_SERVER) {
+        header('Access-Control-Allow-Origin: *');
+    }
+
     send_header_404();
     print_error('filenotfound', 'error', $CFG->wwwroot.'/course/view.php?id='.$COURSE->id); //this is not displayed on IIS??
 }
@@ -2476,6 +2483,12 @@ function send_stored_file($stored_file, $lifetime=null, $filter=0, $forcedownloa
         }
     }
 
+    // Allow cross-origin requests only for Web Services.
+    // This allow to receive requests done by Web Workers or webapps in different domains.
+    if (WS_SERVER) {
+        header('Access-Control-Allow-Origin: *');
+    }
+
     if (empty($filter)) {
         // send the contents
         readfile_accel($stored_file, $mimetype, !$dontdie);
diff --git a/webservice/rest/locallib.php b/webservice/rest/locallib.php
index 403c9b700a5..1ead1513413 100644
--- a/webservice/rest/locallib.php
+++ b/webservice/rest/locallib.php
@@ -184,6 +184,8 @@ class webservice_rest_server extends webservice_base_server {
         header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT');
         header('Pragma: no-cache');
         header('Accept-Ranges: none');
+        // Allow cross-origin requests only for Web Services.
+        // This allow to receive requests done by Web Workers or webapps in different domains.
         header('Access-Control-Allow-Origin: *');
     }