diff --git a/lib/http-worker.js b/lib/http-worker.js
index c46d1b3f7..418198dec 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -161,6 +161,15 @@ var setHeaders = function (req, res) {
     }
 
     var h = getHeaders(Env, type);
+
+    // XXX Allow main domain to load resources from the sandbox URL
+    // We can restrict this to onlyoffice fonts if we find a security issue with this
+    if (!Env.enableEmbedding && req.get('origin') === Env.httpUnsafeOrigin) {
+        //if (/^\/common\/onlyoffice\/dist\/.*\/fonts\/.*/.test(req.url)) {
+        h['Access-Control-Allow-Origin'] = Env.httpUnsafeOrigin;
+        //}
+    }
+
     applyHeaderMap(res, h);
 };