fnmatch.fnmatch can be case-insensitive when the underlying filesystem is case-insensitive.  Better to use fnmatchcase, as the CORS spec requires case-sensitive origin matching.

You could also consider pre-compiling with fnmatch.translate for a small efficiency boost, but it might complicate the code too much to be worth it.