Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Access-Control-Allow-Origin:*