diff --git a/worklets/resources/credentials.py b/worklets/resources/credentials.py
index 8709896d1ba08f..e9fac0e6696eec 100644
--- a/worklets/resources/credentials.py
+++ b/worklets/resources/credentials.py
@@ -1,14 +1,14 @@
 # Returns a valid response when a request has appropriate credentials.
 def main(request, response):
-    cookie = request.cookies.first("cookieName", None)
-    expected_value = request.GET.first("value", None)
-    source_origin = request.headers.get("origin", None)
+    cookie = request.cookies.first(b"cookieName", None)
+    expected_value = request.GET.first(b"value", None)
+    source_origin = request.headers.get(b"origin", None)
 
-    response_headers = [("Content-Type", "text/javascript"),
-                        ("Access-Control-Allow-Origin", source_origin),
-                        ("Access-Control-Allow-Credentials", "true")]
+    response_headers = [(b"Content-Type", b"text/javascript"),
+                        (b"Access-Control-Allow-Origin", source_origin),
+                        (b"Access-Control-Allow-Credentials", b"true")]
 
     if cookie == expected_value:
-        return (200, response_headers, "")
+        return (200, response_headers, u"")
 
     return (404, response_headers)
diff --git a/worklets/resources/referrer-checker.py b/worklets/resources/referrer-checker.py
index 8f3798397431fc..4c6ea6e5c21d3f 100644
--- a/worklets/resources/referrer-checker.py
+++ b/worklets/resources/referrer-checker.py
@@ -6,19 +6,19 @@ def main(request, response):
     # thus cannot be compared with the actual referrer header if it were to
     # contain query params. This works fine if the actual referrer has no
     # query params too.
-    referrer = request.headers.get("referer", "").split("?")[0]
-    referrer_policy = request.GET.first("referrer_policy")
-    expected_referrer = request.GET.first("expected_referrer", "")
-    response_headers = [("Content-Type", "text/javascript"),
-                        ("Access-Control-Allow-Origin", "*")]
+    referrer = request.headers.get(b"referer", b"").split(b"?")[0]
+    referrer_policy = request.GET.first(b"referrer_policy")
+    expected_referrer = request.GET.first(b"expected_referrer", b"")
+    response_headers = [(b"Content-Type", b"text/javascript"),
+                        (b"Access-Control-Allow-Origin", b"*")]
 
-    if referrer_policy == "no-referrer" or referrer_policy == "origin":
+    if referrer_policy == b"no-referrer" or referrer_policy == b"origin":
         if referrer == expected_referrer:
-            return (200, response_headers, "")
+            return (200, response_headers, u"")
         return (404, response_headers)
 
-    if referrer_policy == "same-origin":
+    if referrer_policy == b"same-origin":
         if referrer == expected_referrer:
-            return (200, response_headers, "")
+            return (200, response_headers, u"")
         return (404, response_headers)
     return (404, response_headers)
diff --git a/worklets/resources/set-cookie.py b/worklets/resources/set-cookie.py
index 6da37be94c46e1..1b6eb6c1028c58 100644
--- a/worklets/resources/set-cookie.py
+++ b/worklets/resources/set-cookie.py
@@ -1,9 +1,9 @@
 def main(request, response):
-    name = request.GET.first("name")
-    value = request.GET.first("value")
-    source_origin = request.headers.get("origin", None)
+    name = request.GET.first(b"name")
+    value = request.GET.first(b"value")
+    source_origin = request.headers.get(b"origin", None)
 
-    response_headers = [("Set-Cookie", name + "=" + value),
-                        ("Access-Control-Allow-Origin", source_origin),
-                        ("Access-Control-Allow-Credentials", "true")]
-    return (200, response_headers, "")
+    response_headers = [(b"Set-Cookie", name + b"=" + value),
+                        (b"Access-Control-Allow-Origin", source_origin),
+                        (b"Access-Control-Allow-Credentials", b"true")]
+    return (200, response_headers, u"")
diff --git a/x-frame-options/support/nested.py b/x-frame-options/support/nested.py
index e640f37a2306ab..78c8c18466ed45 100644
--- a/x-frame-options/support/nested.py
+++ b/x-frame-options/support/nested.py
@@ -1,10 +1,10 @@
 def main(request, response):
-    origin = request.GET.first("origin");
-    value = request.GET.first("value");
+    origin = request.GET.first(b"origin");
+    value = request.GET.first(b"value");
     # This is used to solve the race condition we have for postMessages
-    shouldSucceed = request.GET.first("loadShouldSucceed", "false");
-    return ([("Content-Type", "text/html")],
-            """<!DOCTYPE html>
+    shouldSucceed = request.GET.first(b"loadShouldSucceed", b"false");
+    return ([(b"Content-Type", b"text/html")],
+            b"""<!DOCTYPE html>
 <title>XFO.</title>
 <body>
 <script>
diff --git a/x-frame-options/support/redirect.py b/x-frame-options/support/redirect.py
index 0addf2056cbb3a..c6459eb8713406 100644
--- a/x-frame-options/support/redirect.py
+++ b/x-frame-options/support/redirect.py
@@ -1,4 +1,4 @@
 def main(request, response):
     response.status = 302
-    response.headers.set("X-Frame-Options", request.GET.first("value"))
-    response.headers.set("Location", request.GET.first("url"))
+    response.headers.set(b"X-Frame-Options", request.GET.first(b"value"))
+    response.headers.set(b"Location", request.GET.first(b"url"))
diff --git a/x-frame-options/support/xfo.py b/x-frame-options/support/xfo.py
index 619cf553e46bb7..a4762ee58a932a 100644
--- a/x-frame-options/support/xfo.py
+++ b/x-frame-options/support/xfo.py
@@ -1,13 +1,13 @@
 def main(request, response):
-    headers = [("Content-Type", "text/html"), ("X-Frame-Options", request.GET.first("value"))]
+    headers = [(b"Content-Type", b"text/html"), (b"X-Frame-Options", request.GET.first(b"value"))]
 
-    if "value2" in request.GET:
-        headers.append(("X-Frame-Options", request.GET.first("value2")))
+    if b"value2" in request.GET:
+        headers.append((b"X-Frame-Options", request.GET.first(b"value2")))
 
-    if "csp_value" in request.GET:
-        headers.append(("Content-Security-Policy", request.GET.first("csp_value")))
+    if b"csp_value" in request.GET:
+        headers.append((b"Content-Security-Policy", request.GET.first(b"csp_value")))
 
-    body = """<!DOCTYPE html>
+    body = u"""<!DOCTYPE html>
         <html>
         <head>
           <title>XFO.</title>