title: How to enable CORS in python
body: <p>Let me start this with, I do not know python, I've had maybe 1 day going through the python tutorials.  The situation is this.  I have an angular app that has a python app hosted with Apache on a vm in an iframe.  I didn't write the python app, but another developer wrote me an endpoint where I am supposed to be able to post from my angular app.</p>
  
  <p>The developer who made the python endpoint is saying that there is something wrong with my request but I am fairly certain there isn't anything wrong.  I am almost 100% certain that the problem is that there are no CORS headers in the response and/or the response is not set up to respond to the OPTIONS method.  Below is the entirety of the python endpoint:</p>
  
  <pre><code>import os, site, inspect
  site.addsitedir(os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe())))+"/../")
  import json
  from datetime import datetime
  
  import pymongo
  
  from Config import Config
  
  
  def application(environ, start_response):
    response = environ['wsgi.input'].read(int(environ['CONTENT_LENGTH']))
  
    if response:
      json_response = json.loads(response)
  
      document = {
        'payment_id': json_response['payment_id'],
        'log': json_response['log'],
        'login_id': json_response['login_id'],
        'browser': environ.get('HTTP_USER_AGENT', None),
        'ip_address': environ.get('REMOTE_ADDR', None),
        'created_at': datetime.utcnow(),
      }
  
      client = pymongo.MongoClient(Config.getValue('MongoServer'))
      db = client.updatepromise
      db.PaymentLogs.insert(document)
  
      start_response('200 OK', [('Content-Type', 'application/json')
      return '{"success": true}'
  
    start_response('400 Bad Request', [('Content-Type', 'application/json')])
    return '{"success": false}'
  </code></pre>
  
  <p>I have attempted the following to make this work:  I added to both start_response functions more headers so the code looks like this now:</p>
  
  <pre><code>start_response('201 OK', [('Content-Type', 'application/json',
    ('Access-Control-Allow-Headers','authorization'),
    ('Access-Control-Allow-Methods','HEAD, GET, POST, PUT, PATCH, DELETE'),
    ('Access-Control-Allow-Origin','*'),
    ('Access-Control-Max-Age','600'))])
  </code></pre>
  
  <p>Not: I did this both with the 200 and the 400 response at first, and saw no change at all in the response, then just for the heck of it, I decided to change the 200 to a 201, this also did not come through on the response so I suspect this code isn't even getting run for some reason.</p>
  
  <p>Please help, python newb here.</p>
  
  <p>Addendum, i figured this would help, here is what the Headers look like in the response:</p>
  
  <pre><code>General:
  
  Request URL: http://rpc.local/api/payment_log_api.py
  Request Method: OPTIONS
  Status Code: 200 OK
  Remote Address: 10.1.20.233:80
  Referrer Policy: no-referrer-when-downgrade
  
  Response Headers:
  
  Allow: GET,HEAD,POST,OPTIONS
  Connection: Keep-Alive
  Content-Length: 0
  Content-Type: text/x-python
  Date: Fri, 27 Apr 2018 15:18:55 GMT
  Keep-Alive: timeout=5, max=100
  Server: Apache/2.4.18 (Ubuntu)
  
  Request Headers:
  
  Accept: */*
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  Access-Control-Request-Headers: authorization,content-type
  Access-Control-Request-Method: POST
  Connection: keep-alive
  Host: rpc.local
  Origin: http://10.1.20.61:4200
  User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36
  </code></pre>