Why can I use "http://localhost:PORT" with CORS in Spaces?

Thanks for flagging this issue for us. It looks like the input validation in our control panel is a bit too strict here. As a work-around until this experience is improved, you can create CORs configurations for Spaces using the API for origins without a TLD. For example, using s3cmd you can run:

s3cmd setcors cors.xml s3://example-space

Where the contents of the cors.xml file contains your CORs configurations in XML format. For example:

<CORSConfiguration>
 <CORSRule>
   <AllowedOrigin>http://localhost:3000</AllowedOrigin>

   <AllowedMethod>PUT</AllowedMethod>
   <AllowedMethod>POST</AllowedMethod>
   <AllowedMethod>DELETE</AllowedMethod>

   <AllowedHeader>*</AllowedHeader>
 </CORSRule>
</CORSConfiguration>