Bases card view requests remote images twice, logging a CORS error for each

Bug reports
,
1

Steps to reproduce

  1. Create a note with a property pointing at a remote image on a host that doesn’t send
    Access-Control-Allow-Origin — e.g. cover: https://assets.hardcover.app/edition/32462067/40a20ed0-0786-4425-b775-0af66472e853.jpg
  2. Create a base with a cards view using that property:
    views:
  - type: cards
    image: note.cover
  3. Open the view with the console open.
    The card displays the image; the console logs a CORS failure for it.

Did you follow the troubleshooting guide? [Y/N]

Yes

Expected result

Either the image is fetched once in the mode that’s actually needed, or a failed CORS-mode request for an image that has already rendered isn’t surfaced as an error.

Actual result

A Bases cards view whose image is a property holding a remote https:// URL logs a CORS error per image:
Access to image at ‘https://image.tmdb.org/t/p/w500/ww6hnnEnV6qM0LWkopDE7rMKAYr.jpg’
from origin ‘app://obsidian.md’ has been blocked by CORS policy:
No ‘Access-Control-Allow-Origin’ header is present on the requested resource.
Failed to load resource: net::ERR_FAILED
The images render correctly anyway. So the image appears to be requested twice — once
plainly (succeeds, displays) and once in CORS mode (fails, logs). Only the second is visible
as a problem, and it produces one error pair per card.
With a few hundred notes this fills the console and makes it unusable for anything else.

Environment

SYSTEM INFO:
Obsidian version: 1.13.4
Installer version: 1.12.7
Operating system: Darwin Kernel Version 25.5.0: Mon Apr 27 20:41:06 PDT 2026; root:xnu-12377.121.6~2/RELEASE_ARM64_T6030 25.5.0
Login status: not logged in
Language: en
Insider build toggle: off
Live preview: on
Base theme: adapt to system
Community theme: none
Snippets enabled: 4
Restricted mode: off
Plugins installed: 12
Plugins enabled: 11
1: Templater v2.20.6
2: Dataview v0.5.68
3: Chord Sheets v1.8.0
4: Markdown Furigana v1.3.0
5: Media Vault v0.1.0
6: TaskNotes v4.11.1
7: Calendar v1.5.10
8: Hearth v1.17.0
9: Iconic v1.1.10
10: Habit Tracker 21 v2.4.1
11: Full Calendar Remastered v0.13.5
RECOMMENDATIONS:
Custom theme and snippets: for cosmetic issues, please first try updating your theme and disabling your snippets. If still not fixed, please try to make the issue happen in the Sandbox Vault or disable community theme and snippets.
Community plugins: for bugs, please first try updating all your plugins to latest. If still not fixed, please try to make the issue happen in the Sandbox Vault or disable community plugins.

Additional information

Obsidian 1.12.7 · macOS 26.5.1 · default theme
Two host behaviours, both checked with curl:
image.tmdb.org — returns access-control-allow-origin: *, but only when the request
carries an Origin header, and correctly sets Vary: Origin. Errors here look
cache-related: a copy fetched earlier without Origin has no ACAO stored.
assets.hardcover.app — returns no ACAO at all, with or without Origin. Any CORS-mode
request for these will always fail.

2

thanks