Вот такие хедеры есть в запросе на получение HTML страницы:

cache-control
no-cache, no-store
content-language
ru-RU
content-security-policy
object-src 'none'; block-all-mixed-content; img-src 'self' data:; font-src 'self'; style-src 'self' 'unsafe-inline'; base-uri 'self'; script-src 'self' 'unsafe-inline' https://smartcaptcha.yandexcloud.net/; frame-ancestors 'self' http://localhost:3000 https://localhost:3000 http://localhost.fiddler:3000 https://localhost.fiddler:3000 http://DESKTOP-U7FI5S4:3000 https://DESKTOP-U7FI5S4:3000 http://localhost:5000 https://localhost:5000 http://localhost:5001 https://localhost:5001 http://ipv4.fiddler:5001 https://ipv4.fiddler:5001 http://localhost.fiddler:5001 https://localhost.fiddler:5001 http://DESKTOP-U7FI5S4:5001 https://DESKTOP-U7FI5S4:5001 http://localhost:5002 https://localhost:5002 http://localhost:5003 https://localhost:5003 http://localhost:5004 https://localhost:5004 http://localhost:5005 https://localhost:5005 http://localhost
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
date
Fri, 13 Oct 2023 13:03:31 GMT
permissions-policy
accelerometer=(), autoplay=(), camera=(), encrypted-media=(), fullscreen=*, geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(), usb=()
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
server
Kestrel

Кроме того, в теле страницы есть тег с линком на яндексовский скрипт:

<script src="https://smartcaptcha.yandexcloud.net/captcha.js" defer></script>

Сам скрипт приходит вот с такими хедерами:

access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
br
content-length
32541
content-type
application/x-javascript
date
Fri, 13 Oct 2023 19:38:07 GMT
last-modified
Fri, 13 Oct 2023 13:39:04 GMT
server
ycalb
X-Firefox-Spdy
h2
x-server-trace-id
16cd205789210f62:8b5904ec746f6172:16cd255789910f82:1

Как результат, броузер при загрузке страницы кидает в лог ошибку

The resource at “https://smartcaptcha.yandexcloud.net/captcha.js” was blocked due to its Cross-Origin-Resource-Policy header (or lack thereof). See https://developer.mozilla.org/docs/Web/HTTP/Cross-Origin_Resource_Policy_(CORP)#

Как это исправить, кроме как отключить передачу cross-origin-embedder-policy ?