Issue Summary

Carousel, excerpt, and include excerpt widgets on Confluence Cloud fail to render a subset of thumbnail/emoji-style images that are served via the Atlassian Media service. On the affected customer site (wafd.atlassian.net), these image requests go to:

https://api.media.atlassian.com/file/<file-id>/image?collection=emoji-site-...&width=41&height=32&max-age=31536000

and are blocked by the browser with net::ERR_BLOCKED_BY_ORB. The Media endpoint responds with a small JSON payload (Content-Type: application/json; charset=utf-8, ~143 bytes) instead of an image, so those thumbnails never render in the UI.

Other images on the same pages (served directly from wafd.atlassian.net and Atlassian CDN domains) load and display correctly.

Customer report: CES-133847

Steps to Reproduce

1. Log in to Confluence Cloud 

1. Navigate to one of the affected pages.

1. On the page, locate:

• • the carousel widget, and

• • the excerpt / include excerpt widgets.

1. Observe that some of the small images (thumbnails / emoji-style icons) associated with those widgets are not displayed (blank/missing image slots), while other images on the page render correctly.

1. Open DevTools in Chrome or Edge:

• • F12 → go to the Network tab.

• • Filter by Img or by api.media.atlassian.com.

1. Reload the page and inspect the failing image requests. For at least one of the missing thumbnails, you will see a request similar to:
    
    Request URL:https://api.media.atlassian.com/file/caaf7cdd-474c-4621-902a-cc7d4392f9d5/image?collection=emoji-site-88f22b72-0480-4ff0-96dc-e25970c8b0ec&width=41&height=32&max-age=31536000Request Method: GETStatus Code (browser): net::ERR_BLOCKED_BY_ORB
2. Check the Response Headers for this request and note:

• • server: AtlassianEdge

• • content-type: application/json; charset=utf-8

• • content-length: 143

• • x-media-env: prod-west2

• • x-media-region: us-west-2

1. Compare with other image requests on the same page (e.g. served from wafd.atlassian.net or media/CDN domains) which return 200 with Content-Type: image/* and render correctly.

Expected Results

• All images used by carousel, excerpt, and include excerpt widgets (including their thumbnails/emoji-style assets) load and render correctly for all users on supported browsers.
• Requests to https://api.media.atlassian.com/file/<file-id>/image?... return a valid image response:

• • • HTTP 200

• • • Content-Type: image/* (e.g. image/png, image/jpeg)

• No net::ERR_BLOCKED_BY_ORB errors occur for these Media image requests in Chrome or Edge.

Actual Results

• On the affected pages, a subset of small thumbnail/emoji-style images associated with the carousel and excerpt/include excerpt widgets do not render. The UI shows empty or missing image slots.

• In Chrome and Edge DevTools:

• • The failing requests are to https://api.media.atlassian.com/file/<file-id>/image?collection=emoji-site-...&width=41&height=32&max-age=31536000.

• • The browser reports net::ERR_BLOCKED_BY_ORB for these requests.

• • The response from AtlassianEdge is JSON, not an image:

• • • Content-Type: application/json; charset=utf-8

• • • content-length: 143

• Because a cross-origin <img> (or similar image context) receives JSON instead of an image, Chromium’s Opaque Response Blocking (ORB) blocks the response, and the widgets never show those thumbnails.

• Other images on the same pages (served from wafd.atlassian.net and/or Atlassian media/CDN domains with Content-Type: image/*) load with HTTP 200 and display correctly.

• The customer reports the issue affects all tested users and reproduces in Chrome and Edge; first observed between the prior Friday and the current day (recent regression window).

Workaround

• No reliable workaround identified.

• • The failing responses come directly from the Media endpoint (api.media.atlassian.com) as JSON, which is then blocked by Chrome/Edge ORB when used in an image context.

• • Customers cannot configure or bypass this behavior from the Confluence UI.

• Engineering guidance is requested to:

• • Ensure the affected Media endpoints return a proper image/* payload (or avoid returning JSON in an image context), and/or

• • Adjust how these thumbnail/emoji images are requested so they are not subject to ORB blocking.