"""Original two-origin color access experiment. Run Python + Pillow, open localhost:8766.
Only binds loopback; no proxy, credentials, or external image service.
"""
from http.server import ThreadingHTTPServer,BaseHTTPRequestHandler
from threading import Thread
from pathlib import Path
from io import BytesIO
from PIL import Image
import hashlib,json
image=Image.new('RGB',(120,80),(36,132,184));buf=BytesIO();image.save(buf,format='PNG');PNG=buf.getvalue()
HTML='''Original CORS color lab
Same PNG, different access
Original RGB (36,132,184); 120 × 80 pixels. Change request mode and response headers only.
Case
Load
Pixel read
Pixel / error
Image
'''
class Handler(BaseHTTPRequestHandler):
def do_GET(self):
data=HTML.encode() if self.path=='/' else PNG
self.send_response(200);self.send_header('Content-Type','text/html; charset=utf-8' if self.path=='/' else 'image/png');self.send_header('Cache-Control','no-store');self.send_header('Content-Length',str(len(data)))
if self.path.startswith('/allow.png'):self.send_header('Access-Control-Allow-Origin','*')
self.end_headers();self.wfile.write(data)
def log_message(self,*args):pass
if __name__=='__main__':
out=Path(__file__).resolve().parent/'cors-fixture.png';out.write_bytes(PNG)
print(json.dumps({'sha256':hashlib.sha256(PNG).hexdigest(),'bytes':len(PNG),'url':'http://127.0.0.1:8766'}),flush=True)
Thread(target=ThreadingHTTPServer(('127.0.0.1',8767),Handler).serve_forever,daemon=True).start()
ThreadingHTTPServer(('127.0.0.1',8766),Handler).serve_forever()