Skip to content

fix: add crossOrigin="anonymous" to Image component to fix Firefox OpaqueResponseBlocking#291

Open
oxygensmith wants to merge 1 commit into
sanity-io:mainfrom
oxygensmith:fix/firefox-crossorigin-anonymous
Open

fix: add crossOrigin="anonymous" to Image component to fix Firefox OpaqueResponseBlocking#291
oxygensmith wants to merge 1 commit into
sanity-io:mainfrom
oxygensmith:fix/firefox-crossorigin-anonymous

Conversation

@oxygensmith

Copy link
Copy Markdown

In Firefox, all thumbnail images in the media browser fail to load with
OpaqueResponseBlocking errors (NS_BINDING_ABORTED in the network panel).
This does not affect Chrome or Safari.

Root cause: Sanity's CDN returns Vary: Origin on all asset responses.
Firefox's stricter ORB implementation blocks opaque (no-cors) cross-origin
responses when the server declares Vary: Origin. The Image component
renders a plain <img> without a crossOrigin attribute, so the browser
makes a no-cors request and receives an opaque response — which Firefox blocks.

Fix: Adding .attrs({crossOrigin: 'anonymous'}) to the styled component
causes the browser to include an Origin header with every image request.
Sanity's CDN already responds correctly with Access-Control-Allow-Origin
when an Origin is present, so Firefox accepts the response.

What to review

The single change is in src/components/Image/index.tsx — the Image
styled component gains a .attrs({crossOrigin: 'anonymous'}) call.
This affects every place in the plugin that renders image thumbnails
(card view, table view, edit dialog).

Testing

Tested manually by loading the media browser in Firefox with and without
the change. Without it: all thumbnails blocked with NS_BINDING_ABORTED.
With it: all thumbnails load correctly. No regression observed in Chrome.

Automated testing for a browser-specific network behaviour wasn't practical.

@vercel

vercel Bot commented Apr 26, 2026

Copy link
Copy Markdown

@oxygensmith is attempting to deploy a commit to the Sanity Sandbox Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant