diff --git a/spec/api-protocol-spec.coffee b/spec/api-protocol-spec.coffee
index d160512cd7..5332b2b17c 100644
--- a/spec/api-protocol-spec.coffee
+++ b/spec/api-protocol-spec.coffee
@@ -81,6 +81,21 @@ describe 'protocol module', ->
           error: (xhr, errorType, error) ->
             done(error)
 
+    it 'sets Access-Control-Allow-Origin', (done) ->
+      handler = (request, callback) -> callback(text)
+      protocol.registerStringProtocol protocolName, handler, (error) ->
+        return done(error) if error
+        $.ajax
+          url: "#{protocolName}://fake-host"
+          success: (data, status, request) ->
+            assert.equal data, text
+            assert.equal(
+              request.getResponseHeader('Access-Control-Allow-Origin'),
+              '*')
+            done()
+          error: (xhr, errorType, error) ->
+            done(error)
+
     it 'sends object as response', (done) ->
       handler = (request, callback) -> callback(data: text, mimeType: 'text/html')
       protocol.registerStringProtocol protocolName, handler, (error) ->
@@ -120,6 +135,21 @@ describe 'protocol module', ->
           error: (xhr, errorType, error) ->
             done(error)
 
+    it 'sets Access-Control-Allow-Origin', (done) ->
+      handler = (request, callback) -> callback(buffer)
+      protocol.registerBufferProtocol protocolName, handler, (error) ->
+        return done(error) if error
+        $.ajax
+          url: "#{protocolName}://fake-host"
+          success: (data, status, request) ->
+            assert.equal data, text
+            assert.equal(
+              request.getResponseHeader('Access-Control-Allow-Origin'),
+              '*')
+            done()
+          error: (xhr, errorType, error) ->
+            done(error)
+
     it 'sends object as response', (done) ->
       handler = (request, callback) -> callback(data: buffer, mimeType: 'text/html')
       protocol.registerBufferProtocol protocolName, handler, (error) ->
@@ -163,6 +193,21 @@ describe 'protocol module', ->
           error: (xhr, errorType, error) ->
             done(error)
 
+    it 'sets Access-Control-Allow-Origin', (done) ->
+      handler = (request, callback) -> callback(filePath)
+      protocol.registerFileProtocol protocolName, handler, (error) ->
+        return done(error) if error
+        $.ajax
+          url: "#{protocolName}://fake-host"
+          success: (data, status, request) ->
+            assert.equal data, String(fileContent)
+            assert.equal(
+              request.getResponseHeader('Access-Control-Allow-Origin'),
+              '*')
+            done()
+          error: (xhr, errorType, error) ->
+            done(error)
+
     it 'sends object as response', (done) ->
       handler = (request, callback) -> callback(path: filePath)
       protocol.registerFileProtocol protocolName, handler, (error) ->