Fix: GameMaker HTML5 Export CORS Error on Loader

You export to HTML5 and double-click index.html to test. The browser opens but immediately throws CORS errors: “Access to fetch at ‘file:///…data.json’ has been blocked by CORS policy”. The build seems broken; it’s actually a browser-security thing.

file:// vs http://

Browsers treat file:// origins very restrictively. AJAX requests, fetch, and even some image loads fail because the browser can’t determine which file:// paths should access which others. The HTML5 build is fine; the loading environment isn’t.

Fix 1: Local HTTP Server

# In the export folder
python -m http.server 8000

Visit http://localhost:8000 in the browser. All assets load correctly because everything is same-origin under that HTTP server. No CORS warnings.

Alternatives: Node’s npx serve, PHP’s built-in server, Visual Studio Code’s Live Server extension.

Fix 2: Itch.io Hosting

Upload the HTML5 export to itch.io as an HTML5 game project. Itch hosts the static files with proper CORS and MIME headers automatically. The most common professional hosting target for GameMaker HTML5 builds.

Fix 3: Your Own Hosting CORS Config

For nginx:

location / {
    add_header Access-Control-Allow-Origin "*";
    add_header Access-Control-Allow-Methods "GET, OPTIONS";
    types {
        application/json   json;
        audio/ogg          ogg;
        audio/mpeg         mp3;
    }
}

Apache (.htaccess):

Header set Access-Control-Allow-Origin "*"
AddType audio/ogg .ogg
AddType audio/mpeg .mp3

Audio MIME Types

If sound files load on Chrome but fail on Safari, MIME type is likely missing. Safari is strict about audio Content-Type. Verify with curl:

curl -I https://your.host/game/snd_explosion.ogg
# Should include: Content-Type: audio/ogg

If it returns application/octet-stream, configure your server to assign proper types.

Verifying

Open the served URL. Check the browser console (F12). No CORS errors. Game loads to title screen. Audio plays correctly. If still failing, the specific error message names the failing asset — check that file’s headers.

Understanding the issue

Export pipelines transform development assets into shipping packages. Each transformation can introduce subtle changes that produce bugs only visible in the exported build.

The specific bug described above is the kind that surfaces during integration rather than unit testing. It depends on a combination of factors: the asset configuration, the runtime state, the platform's specific behavior. In isolation, each piece looks correct; in combination, the bug emerges. This is why thorough integration testing - playing the actual game in realistic conditions - catches things that automated tests miss.

Why this happens

The triage path for this kind of bug is long. The symptom appears in gameplay, but the cause is in a different system. The reporter describes the gameplay effect; the engineer has to translate that into a hypothesis about the underlying cause. Misdirection is common.

At the engine level, the behavior comes from a deliberate design decision in GameMaker. The engine team chose a particular trade-off - usually performance versus convenience, or generality versus specificity - and that trade-off has consequences when you push against it. Understanding the trade-off is what turns 'this bug is mysterious' into 'this bug is the expected consequence of this design'.

Verifying the fix

For shipping games, the safest verification is a staged rollout. Apply the fix to 1% of players for 24 hours; watch the affected metric; expand if green. Skipping the staged rollout means the verification is the entire player base, which is too high a stakes for most fixes.

Reproducibility is the prerequisite for verification. If you can't reliably reproduce the bug pre-fix, you can't reliably verify it post-fix. Spend time getting a clean reproduction before you write any fix code. The fix is fast once you understand the reproduction; the reproduction is the slow part.

Variations to watch for

Related bug classes often share the same root cause. If you find yourself fixing this issue, look for cousins: similar symptoms in adjacent systems, the same data flow but a different value, or the same fix pattern in another module. The catalog of 'we've seen this before' becomes valuable institutional knowledge.

Adjacent bugs often share a root cause. After fixing the case you've found, spend an hour searching the codebase for similar patterns. What's the same call with different arguments? The same data flow with a different entity type? The same lifecycle issue in a sibling system? Each match is a candidate for the same fix, or a related fix that prevents future bugs of the same class.

In production

For shipping titles with a long support window, watch for this issue resurfacing after dependency updates. Engine upgrades, driver updates, OS releases - each one can resurface a bug class you thought you'd fixed because the underlying behavior changed slightly. Regression tests catch the obvious ones; player reports catch the rest.

When triaging a similar issue in production, prioritize gathering data over hypothesizing causes. A player report describes a symptom; what you need is a build SHA, a session timestamp, and ideally a screen recording or session replay. With those, the bug becomes tractable. Without them, you're guessing at hypothetical reproductions that may not match what the player actually hit.

Performance considerations

Performance implications matter when this bug class scales with player count or asset count. A bug that fires once per session is annoying; a bug that fires once per frame compounds. After fixing, profile the affected code path under realistic load. The fix that's correct for one entity may be too slow for ten thousand.

Diagnostic approach

Diagnosing this class of bug benefits from a structured approach: confirm the symptom, isolate the variables, hypothesize the cause, and verify the hypothesis before writing fix code. Skipping the isolation step is the most common mistake; without it, fixes often address symptoms while the underlying cause continues to produce other variations.

For GameMaker-specific diagnostics, the editor's profiler is the canonical starting point. Capture a representative frame with the symptom present; compare against a frame without the symptom; the diff often points directly at the cause. If the symptom is non-deterministic, capture multiple frames and look for the pattern - the cause is usually a state transition or a specific input value rather than a continuous effect.

Tooling and ecosystem

Modern engine versions ship better tooling for this kind of issue than older versions. If you're on an older release, the diagnostic step may take significantly longer because the tools you'd want don't exist yet. Sometimes the right answer is upgrading rather than fighting through limited tooling.

Within GameMaker, the relevant diagnostic surfaces include the standard frame debugger, memory profiler, and engine-specific debug overlays. Each one shows a different facet of what's happening. The frame debugger reveals draw call ordering and state transitions; the memory profiler shows allocation patterns; the debug overlay reveals per-system state. Bugs that resist one tool usually surrender to another - the trick is knowing which tool to reach for first.

Edge cases and pitfalls

Boundary conditions deserve specific testing attention. What happens when the input is zero, maximum, negative, or NaN? What happens at the start of a session vs hours in? What happens at the boundary between two systems handling the same data? These are where bugs hide and where regression tests are most valuable.

When writing a regression test for this fix, focus on the boundary conditions that surfaced the original bug. Tests that exercise the happy path catch obvious regressions; tests that exercise the boundary catch the subtler regressions that look like new bugs but are really the original returning. The latter are the tests that earn their keep over the long life of the project.

Team communication

When this bug class affects multiple teams (often the case for cross-system issues), early communication prevents duplicate work. The team that owns the symptom may not own the cause. A 15-minute conversation at the start of triage often saves hours of independent investigation.

If this fix touches a system several engineers work in, a short writeup in the team's engineering channel helps. Not a full design doc - a paragraph explaining what was wrong, what's fixed, and what to watch for. Future engineers encountering similar symptoms will search for the fix; making it findable is a small investment that pays back later.

“file:// breaks HTML5 builds. Serve over HTTP, locally for testing and on a real CDN with CORS headers for shipping.”

Document the local-test command (python -m http.server) in your project README — saves teammates the first-time CORS confusion.