Describe the bug:

I configured Forgejo as an OIDC app in VoidAuth. Forgejo accepts an Icon URL for the authentication source.
This is used on the app authentication page on the 'Sign in with VoidAuth' button.

Trying to set https://voidauth.example.com/logo.svg as the Icon URL does not work. When the forgejo login page is loaded, the request for the voidauth logo fails with NS_ERROR_DOM_CORP_FAILED.

If I understand correctly, this is because the request for the logo receives a response with the header cross-origin-resource-policy: same-origin. Perhaps this header is not necessary or could be set to cross-origin for the logo?