Support COEP require-corp for public extension asset responses

[conwnet]

Description

Public extension assets served through Open VSX cannot currently be embedded by pages using:

Cross-Origin-Embedder-Policy: require-corp

when the resource is requested in no-cors mode, such as an <img> element without a crossorigin attribute.

This affects cross-origin-isolated web IDEs that load extension icons and other public assets from Open VSX. If the COOP/COEP headers are not configured, the SharedArrayBuffer of the origin server will not be usable.

Reproduction

Serve the following page with Cross-Origin-Embedder-Policy: require-corp:

<img src="https://open-vsx.org/vscode/asset/ms-python/vscode-python-envs/1.36.0/Microsoft.VisualStudio.Services.Icons.Default?targetPlatform=universal" />

Chromium blocks the request with an error similar to:

net::ERR_BLOCKED_BY_RESPONSE.NotSameOriginAfterDefaultedToSameOriginByCoep

Current response chain

The asset endpoint first returns a redirect:

GET https://open-vsx.org/vscode/asset/ms-python/vscode-python-envs/1.36.0/Microsoft.VisualStudio.Services.Icons.Default?targetPlatform=universal

HTTP/2 302
Location: https://openvsx.eclipsecontent.org/ms-python/vscode-python-envs/1.36.0/icon.png
Access-Control-Allow-Origin: <request origin>

The CDN then returns the image:

GET https://openvsx.eclipsecontent.org/ms-python/vscode-python-envs/1.36.0/icon.png

HTTP/2 200
Content-Type: image/png
Access-Control-Allow-Origin: *

Neither response currently includes:

Cross-Origin-Resource-Policy: cross-origin

The existing CORS headers do not help when the resource is requested in no-cors mode. Under COEP: require-corp, a response without a valid CORP header
defaults to same-origin and is therefore blocked.

The Fetch Standard performs the CORP check before following an HTTP redirect, so both the initial redirect response and the final CDN response need to opt in:

https://fetch.spec.whatwg.org/#http-fetch

Expected behavior

Public extension assets should be loadable from cross-origin-isolated applications using COEP: require-corp.

Suggested direction

For public extension asset delivery:

• Add Cross-Origin-Resource-Policy: cross-origin to responses from public asset endpoints such as /vscode/asset/**, including redirect responses.
• Ensure the final resource returned by the configured storage provider or CDN also includes the same header.
• Keep the existing CORS headers for consumers that explicitly use CORS mode.
• Scope this behavior to public extension assets rather than authenticated or user-specific API responses.

The final CDN header may require deployment-specific configuration for the public open-vsx.org instance. The core implementation could define or document the
required response-header contract, with the corresponding infrastructure change tracked in EclipseFdn/open-vsx.org if necessary.