python -m http.server with CORS (tested)

python -m http.server sends no CORS headers, so a page on another port can't fetch() from it. The common fix -- override end_headers() to add Access-Control-Allow-Origin: * -- works for a plain GET. We measured in Chromium 153 that it still fails for any request with an Authorization header or a JSON Content-Type, because those trigger an OPTIONS preflight that SimpleHTTPRequestHandler answers with 501. Below is a drop-in script that handles both.

1. python -m http.server has no CORS option

python3 -m http.server --help in Python 3.13.5 lists no CORS flag, and SimpleHTTPRequestHandler sends no Access-Control-Allow-Origin header. A page on another origin -- and a different port counts, so localhost:3000 fetching from localhost:8000 is cross-origin -- gets this in Chromium 153's console:

Access to fetch at 'http://127.0.0.1:8964/data.json' from origin 'http://127.0.0.1:8966' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

2. A drop-in replacement with CORS (and preflight)

Save as cors_server.py and run python3 cors_server.py preflight 8000 from the directory you want to serve:

import sys
from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer

class CORSRequestHandler(SimpleHTTPRequestHandler):
    def end_headers(self):
        self.send_header("Access-Control-Allow-Origin", "*")
        super().end_headers()

class CORSPreflightHandler(CORSRequestHandler):
    def do_OPTIONS(self):
        self.send_response(204)
        self.send_header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
        self.send_header("Access-Control-Allow-Headers", "Content-Type, Authorization")
        self.send_header("Access-Control-Max-Age", "600")
        self.end_headers()

handler = {"plain": SimpleHTTPRequestHandler, "cors": CORSRequestHandler,
           "preflight": CORSPreflightHandler}[sys.argv[1]]
ThreadingHTTPServer(("127.0.0.1", int(sys.argv[2])), handler).serve_forever()

Overriding end_headers() adds the header to every response the handler sends, including 404s and directory listings. do_OPTIONS answers the browser's preflight.

3. What the browser allowed, per handler

We served the same data.json with each handler on its own port and called fetch() from a page on http://127.0.0.1:8966 in headless Chromium 153:

plain      GET                          BLOCKED: Failed to fetch
plain      GET + Authorization header   BLOCKED: Failed to fetch
plain      POST application/json        BLOCKED: Failed to fetch
cors       GET                          200 {"ok": true}
cors       GET + Authorization header   BLOCKED: Failed to fetch
cors       POST application/json        BLOCKED: Failed to fetch
preflight  GET                          200 {"ok": true}
preflight  GET + Authorization header   200 {"ok": true}
preflight  POST application/json        501 <!DOCTYPE HTML>...

Measured:

• Header only (cors) fixes a plain GET but nothing that needs a preflight. Adding an Authorization header, a custom header, or Content-Type: application/json makes the browser send OPTIONS first, and SimpleHTTPRequestHandler has no do_OPTIONS, so it answers 501 Unsupported method ('OPTIONS'). Chromium reports: Response to preflight request doesn't pass access control check: It does not have HTTP ok status. Most copy-paste snippets stop at the header and hit this.
• With do_OPTIONS (preflight) the preflight passes. The POST then reaches the server and gets a readable 501, because SimpleHTTPRequestHandler is a static file server with no do_POST. That's no longer a CORS problem: add your own do_POST if you need one.

4. Check it with curl

$ curl -s -i -X OPTIONS http://127.0.0.1:8965/data.json   # header-only handler
HTTP/1.0 501 Unsupported method ('OPTIONS')

$ curl -s -i -X OPTIONS http://127.0.0.1:8967/data.json -H 'Origin: http://127.0.0.1:8966'
HTTP/1.0 204 No Content
Server: SimpleHTTP/0.6 Python/3.13.5
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-Age: 600
Access-Control-Allow-Origin: *

(Date header omitted.) Access-Control-Allow-Origin: * is fine for local development of public, non-credentialed files. It does not work with fetch(..., {credentials: 'include'}) -- that needs the exact origin echoed back plus Access-Control-Allow-Credentials: true -- and don't use it on a server that serves anything private: http.server is not meant for production.

Related: CORS preflight (OPTIONS) explained and CORS error messages explained.

Written with AI assistance. Measured on 2026-10-09 with Python 3.13.5's http.server (SimpleHTTPRequestHandler, ThreadingHTTPServer), headless Chromium 153.0.8010.12 via Playwright, and curl, serving one JSON file on separate localhost ports to a page on another port. PlainHeaders is our extension; Python, Chromium and curl are free.