[Bug]: CDN missing CORP header (for filetype icons)

[tomi-bigpi]

Package

react-file-type-icons

Package version

8.16.0

React version

18.2.0

Environment

Not relevant

Current Behavior

Assets such as https://res.cdn.office.net/files/fabric-cdn-prod_20260113.001/assets/item-types/24/docx.svg do not send the cross-origin-resource-policy header.

Expected Behavior

A cross-origin-resource-policy: cross-origin header is expected for all publicly usable CDN assets to allow users to specify COEP headers on their sites.

Reproduction

N/A as reproduction requires setting server headers. Use curl -I https://res.cdn.office.net/files/fabric-cdn-prod_20260113.001/assets/item-types/24/docx.svg to confirm header isn't present.

Steps to reproduce

1. Use existing app or create a React app that uses the "@fluentui/react-file-type-icons" package
2. Set the site server to return the COEP header as Cross-Origin-Embedder-Policy: require-corp
3. Attempt to load images will fail.

Example errors from Chrome:

Are you reporting an Accessibility issue?

None

Suggested severity

Medium - Has workaround

Products/sites affected

No response

Are you willing to submit a PR to fix?

no

Validations

• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• The provided reproduction is a minimal reproducible example of the bug.

[dmytrokirpa]

Hey @tomi-bigpi, appreciate you opening an issue about this! Just a heads up, our team (FluentUI) actually doesn’t manage the CDN for filetype icons - we just consumers of it, so we don’t have access to make changes or help out with it

[tomi-bigpi]

Hey @tomi-bigpi, appreciate you opening an issue about this! Just a heads up, our team (FluentUI) actually doesn’t manage the CDN for filetype icons - we just consumers of it, so we don’t have access to make changes or help out with it

Do you happen to know the appropriate channel to report this to the owners?

[dmytrokirpa]

As far as I know, it's not open-source, so unless you're a Microsoft employee, you probably can't report it. @micahgodbolt, please correct me if I'm wrong