Repository navigation
Add a --cors command line option to stdlib http.server #135056
Description
Feature or enhancement
Proposal:
Add a --cors command line option to the http.server stdlib module, which when specified will add this CORS header to all responses:
Access-Control-Allow-Origin: *
This is useful during local web development, which is a common use case for http.server. If a user is developing Javascript on one local web server, and making Javascript requests against static assets served by a separately running python -m http.server, those requests will fail due to the browser's default cross-origin request policy. With the rise in popularity of tools like pyodide and pyscript, whose implementations are subject to the same Javascript cross-origin request logic, I expect similar use cases to this to become more common. It would be useful for http.server to support an open cross-origin response header via the command line like so:
python -m http.server --corsThis allows the user to serve static assets locally that can be requested by Javascript anywhere the server is visible. The new headers are opt-in only, no default behavior is changed without the flag.
Has this already been discussed elsewhere?
I have already discussed this feature proposal on Discourse
Links to previous discussion of this feature:
I started a thread about this feature on python-ideas:
https://discuss.python.org/t/any-interest-in-adding-a-cors-option-to-python-m-http-server/92120/10
The thread has a mixed response. Some are for it, some against, and some are in favor of a more generalized approach. I discussed the feature with some developers in person at Pycon 2025, the result being that there is possibly enough interest to add this feature.
Activity
pythongh-135056: Add a --cors CLI argument to http.server
pythongh-135056: Add a --cors CLI argument to http.server
pythongh-135056: Add a --cors CLI argument to http.server
pythongh-135056: Simplifications and cleanups to http cors changes.
pythongh-135056: Add a --header argument to http.server cli.
pythongh-135056: Remove --cors opt from http.server in favor of --header
pythongh-135056: Use response_headers only in SimpleHTTPRequestHandler
pythongh-135056: Add test for http.server cli --header argument
pythongh-135056: Support multiple headers of the same name.
pythongh-135056: Remove some commented out and unused code.
pythongh-135056: Capitalize CLI acronym in the docs.
pythongh-135056: Simplify args.header processing.
pythongh-135056: Factor out a _make_server function from test function.
29 remaining items
pythongh-135056: Fix socket closing in test_extra_response_headers_arg
pythongh-135056: Don't let extra headers overwrite default headers
pythongh-135056: Don't let extra headers overwrite default headers
pythongh-135056: Fix attribute access to default_response_headers
pythongh-135056: Use proper RST syntax for attribute references.
pythongh-135056: Make more new args and attrs private.
pythongh-135056: Add multithreaded test for extra_response_headers
pythongh-135056: Fix test_extra_response_headers_concurrent_requests
pythongh-135056: Don't raise exceptions in threaded tests child threads.
pythongh-135056: Add addCleanup calls to ensure test server thread ex…
pythongh-135056: Refactor _default_reponse_headers usage.
pythongh-135056: Remove test_extra_response_headers_concurrent_requests
gh-135056: Add a `--header` CLI option to `http.server` (#135057)
gh-135056: Fix teardown order for Windows in `test_httpservers` (#149320