Why does opening the HTML5 build directly produce CORS errors?

Browsers treat file:// loads as cross-origin against the bundled JSON/audio assets, blocking them by default. Run a local HTTP server (python -m http.server) and visit http://localhost:8000 instead of opening index.html directly.

How do I set CORS headers for hosted builds?

For static hosting via nginx or itch.io, ensure Access-Control-Allow-Origin: * (or specific origins). Itch.io handles this automatically for game pages. For your own server, configure in nginx.conf or .htaccess.

Why do some sounds fail but not others?

Audio files use different MIME types. WebKit-based browsers reject audio without proper Content-Type. Configure your server to send audio/ogg, audio/mpeg, etc. correctly.

Fix: GameMaker HTML5 Export CORS Error on Loader

Quick answer: Serve over HTTP, not file://. Run python -m http.server in the export folder for local testing. For deployment, use itch.io or set CORS headers on your CDN.

You export to HTML5 and double-click index.html to test. The browser opens but immediately throws CORS errors: “Access to fetch at ‘file:///…data.json’ has been blocked by CORS policy”. The build seems broken; it’s actually a browser-security thing.

file:// vs http://

Browsers treat file:// origins very restrictively. AJAX requests, fetch, and even some image loads fail because the browser can’t determine which file:// paths should access which others. The HTML5 build is fine; the loading environment isn’t.

Fix 1: Local HTTP Server

# In the export folder
python -m http.server 8000

Visit http://localhost:8000 in the browser. All assets load correctly because everything is same-origin under that HTTP server. No CORS warnings.

Alternatives: Node’s npx serve, PHP’s built-in server, Visual Studio Code’s Live Server extension.

Fix 2: Itch.io Hosting

Upload the HTML5 export to itch.io as an HTML5 game project. Itch hosts the static files with proper CORS and MIME headers automatically. The most common professional hosting target for GameMaker HTML5 builds.

Fix 3: Your Own Hosting CORS Config

For nginx:

location / {
    add_header Access-Control-Allow-Origin "*";
    add_header Access-Control-Allow-Methods "GET, OPTIONS";
    types {
        application/json   json;
        audio/ogg          ogg;
        audio/mpeg         mp3;
    }
}

Apache (.htaccess):

Header set Access-Control-Allow-Origin "*"
AddType audio/ogg .ogg
AddType audio/mpeg .mp3

Audio MIME Types

If sound files load on Chrome but fail on Safari, MIME type is likely missing. Safari is strict about audio Content-Type. Verify with curl:

curl -I https://your.host/game/snd_explosion.ogg
# Should include: Content-Type: audio/ogg

If it returns application/octet-stream, configure your server to assign proper types.

Verifying

Open the served URL. Check the browser console (F12). No CORS errors. Game loads to title screen. Audio plays correctly. If still failing, the specific error message names the failing asset — check that file’s headers.

“file:// breaks HTML5 builds. Serve over HTTP, locally for testing and on a real CDN with CORS headers for shipping.”

Document the local-test command (python -m http.server) in your project README — saves teammates the first-time CORS confusion.