(Regression) embedding images via CSS on other origins fails in dev

[MattIPv4]

Link to the code that reproduces this issue

https://codesandbox.io/p/devbox/interesting-rhodes-l4rv48

To Reproduce

1. Start the application in development mode
2. On another origin, add the image as a background in CSS
3. Ensure the other origin is in allowedDevOrigins

Current vs. Expected behavior

Image fails to load, blocked by Next.js. It should load.

Provide environment information

Operating System:
  Platform: linux
  Arch: x64
  Version: #1 SMP PREEMPT_DYNAMIC Sun Aug  6 20:05:33 UTC 2023
  Available memory (MB): 4242
  Available CPU cores: 2
Binaries:
  Node: 20.9.0
  npm: 9.8.1
  Yarn: 1.22.19
  pnpm: 8.10.2
Relevant Packages:
  next: 15.3.0-canary.15 // Latest available version is detected (15.3.0-canary.15).
  eslint-config-next: N/A
  react: 19.0.0
  react-dom: 19.0.0
  typescript: 5.3.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Image (next/image), Not sure

Which stage(s) are affected? (Select all that apply)

next dev (local)

Additional context

I suspect this is a regression caused by #76880

[MattIPv4]

@ztanner I'm concerned by this:

In a future major release, this will not be opt-in, and will require explicitly providing the allowed origins that can access the special /_next endpoints.

As I noted in this issue, CSS image requests cannot pass CORS headers, so unless there is going to be a way to completely disable this check for /_next/image, this issue is just going to reocurr when this is switched to not being opt-in again?

[ztanner]

@ztanner I'm concerned by this:

In a future major release, this will not be opt-in, and will require explicitly providing the allowed origins that can access the special /_next endpoints.

As I noted in this issue, CSS image requests cannot pass CORS headers, so unless there is going to be a way to completely disable this check for /_next/image, this issue is just going to reocurr when this is switched to not being opt-in again?

Thanks for flagging this-- we'll make sure that we get a test-case for this landed before we make the flag opt-in by default.