Same-origin archive

Same-origin Orion Nebula plate

Native request policy applies before src. Citry does not proxy bytes.

Credential-free CORS mode

Observatory plate requested in anonymous CORS mode

The response still needs matching server headers for CORS use.

CSP and unavailable resources

Archive plate unavailable under the current image policy

Browser CSP remains authoritative and failures settle as image error.