PyScript configuration: Pyodide package loading and CORS restrictions

Question

PyScript utilizes a configuration file to define the necessary Pyodide packages and custom Python modules required for the runtime environment. Because the execution occurs within a sandboxed browser environment via WebAssembly, the loading process is subject to browser security policies.

When specifying external dependencies or custom modules in the configuration, the interaction between the PyScript runtime and the remote server must adhere to Cross-Origin Resource Sharing (CORS) requirements. There is uncertainty regarding the behavior of the runtime when a specified package is available but the server headers restrict the request.

Does the PyScript runtime provide a specific mechanism to handle CORS preflight failures during the initial package loading phase?
  How does the runtime distinguish between a missing package and a package blocked by browser security policies in the configuration log?

Tasadduq Burney · Answer

Answer PyScript does not provide a special CORS‑preflight interception mechanism; it relies on Pyodide’s standard fetch API, so a CORS block appears as a normal fetch error. How the runtime reports the two situations Missing package (HTTP 404): Pyodide receives an error response and PyScript logs a message like Package not found (404). CORS‑blocked request: The browser aborts the fetch before any data is returned; PyScript logs a generic network error such as Failed to fetch package : NetworkError when attempting to fetch resource and the DevTools Console shows a CORS policy warning. Verification steps Open DevTools → Network tab, reload the page, and locate the request for the Pyodide package (usually a .wasm or .js file). If the request shows status 404, the package is truly missing. If the request is marked "(failed)" and the Console contains an "Access to fetch … has been blocked by CORS policy" warning, the issue is CORS. To confirm, temporarily serve the package from the same origin as the page or add the appropriate Access-Control-Allow-Origin header; if the error disappears and the package loads, the original problem was CORS‑related.

PyScript configuration: Pyodide package loading and CORS restrictions

1 answer

Answer

How the runtime reports the two situations

Verification steps

Your perspective belongs here.

0 question comments