CMost likely your app returns CORS headers, but the managed challenge page doesn't return them
CIf you're fine with your images endpoint being a bit vulnerable
CYou can disable bot fight / bot detection on the specific subdomain / route using a page rule or configuration rule
