As an alternative to a firewall, you can (and should) bind the server to only listen on the loopback interface. The
http.server script takes
-h as a parameter to print out help information, which will tell you that it takes port as an optional parameter (defaulting to 8000) and
--bind <ADDRESS> as an optional parameter (defaulting to all interfaces).
For a server that will only be accessed on your local computer, you should instead bind to the loopback device, which is technically any address in the 127.0.0.0 /8 network range, but by convention the address
127.0.0.1 is used (for IPv4, which is what
http.server expects). This address is commonly named "localhost".
As such (and taking into account the very good advice to not run the server as root), you should start your server using
python3 -m http.server --bind 127.0.0.1 8080 or
python3 -m http.server --bind localhost 8080. This will prevent any external machines - even on your local LAN, much less the Internet - from connecting to the server at all, and doesn't require configuring or even having a firewall.
With that said, note that there still may be ways to attack the server. For example, web pages could attack it from your own browser; if you visit a page that contains
<img src="http://localhost:8080/do_thing"> in the HTML, your browser will send a GET request to the server's
This is a way to use CSRF attacks to attack a server even if it is behind a firewall or only bound to loopback. Preventing that would require running the server in an isolated network namespace that your browser can't talk to (except, presumably, for a browser that you launch also in that namespace, but which can't talk to the Internet). Of course, such an attack is extremely unlikely in practice, and you can also avoid it by just not having any browser tabs open to Internet pages while the server is running (or at least, having tabs only open to pages you trust to not attempt such things).