[Bug] Manual Match cover previews blocked when RomM is served with COEP require-corp

RomM version
5.2.0

Installation
Docker, accessed through a reverse proxy

Clients tested

• Desktop browser (Firefox)
• Android mobile browser

Describe the bug

Cover artwork does not load in the Match ROM search-results dialog when RomM is served with the cross-origin isolation headers required for threaded EmulatorJS cores:

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

The metadata search itself works correctly. Results are returned, names and provider information appear, and the ROM can be successfully matched.

However, the remote cover artwork in the search results is blocked by the browser.

After selecting the result and completing the match, the cover artwork displays normally in RomM.

Why COOP/COEP are enabled

These headers are enabled intentionally to support SharedArrayBuffer / threaded WebAssembly for EmulatorJS cores such as DOSBox Pure.

Removing Cross-Origin-Embedder-Policy: require-corp is therefore not a desirable workaround because it can break browser-based emulation that requires cross-origin isolation.

To reproduce

1. Serve RomM through a reverse proxy with:

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp

1. Open a ROM in RomM.
2. Select Match ROM.
3. Search for a game using IGDB.
4. Observe that the search result is returned successfully, but its cover image does not load.
5. Open the browser console.

For example, Firefox reports:

The resource at “https://images.igdb.com/igdb/image/upload/...”
was blocked due to its Cross-Origin-Resource-Policy header
(or lack thereof).

1. Select the result and complete the match.
2. Observe that the game's cover art then displays normally in RomM.

The issue occurs on both desktop and Android.

Observed behavior

The Match ROM dialog appears to load provider artwork directly from the third-party image URL, for example:

https://images.igdb.com/...

Because the RomM page is served with:

Cross-Origin-Embedder-Policy: require-corp

the browser refuses to embed that cross-origin image when the image host does not return an appropriate Cross-Origin-Resource-Policy or CORS response.

The local RomM UI graphics and metadata-provider icons display normally.

Expected behavior

Manual-match cover previews should display even when RomM is configured with the COOP/COEP headers needed for supported EmulatorJS cores.

Possible solution

Rather than sending the provider's remote image URL directly to the browser, RomM could proxy/cache manual-match artwork through its own backend and serve the preview from the RomM origin.

For example:

Browser
  -> RomM cover proxy
      -> images.igdb.com

rather than:

Browser
  -> images.igdb.com

This would make the preview same-origin from the browser's perspective and allow RomM to retain:

Cross-Origin-Embedder-Policy: require-corp

without breaking metadata search artwork.

This also seems preferable to recommending that users remove COEP, because doing so can disable SharedArrayBuffer support required by threaded EmulatorJS cores.

AI assistance disclosure

I used ChatGPT to help organize troubleshooting results, review relevant source code/documentation, and draft this report. The issue, reproduction steps, screenshots, testing results, and observations described above are based on my own RomM installation and testing. I reviewed the report before submitting it.