Image previews no longer working on v4.2.3

[WebFreak001]

Describe the bug

After upgrading to v4.2.3, all image content served from the server seems to have stopped displaying (space & room thumbnails, stickers, custom emotes, uploaded media, url preview images)

A few images that fall in these categories still seem to work, but I can't really find a pattern what makes this happen. (perhaps cache?)

Reproduction

1. upgrade to v4.2.3
2. open up any chat with images, custom emotes, stickers or a logo of the chat
3. see that all images don't load

Expected behavior

Images should work

Platform and versions

Browser: Firefox 132.0.1 and Brave 1.70.123
Cinny: v4.2.3 
Homeserver: Synapse v1.118.0

Additional context

Sample image it tries to load:
https://<homeserver>/_matrix/client/v1/media/download/<homeserver>/QwNsrOVdyNrmnqyZFjTdunpS?allow_redirect=true
response:

HTTP Error 401 (Unauthorized)

{"errcode":"M_MISSING_TOKEN","error":"Missing access token"}

When looking at the request headers, they do not include any authorization token or cookie and are sent like an anonymous request.

[WebFreak001]

going into the settings and clicking this "Clear Cache & Reload" button:

fixed the issue

[Lunaphied]

This is still relevant, I'm hitting this issue with a cleared cache (in fact a brand new first load of Cinny in the browser or desktop app, it happens with both) and it's caused by the same issue, not including an authorization token whatsoever in the requests anymore. I'm not sure why that's stopped but I am using Dendrite, which I can confirm is correctly sending the feature in the versions query:

{"versions":["r0.0.1","r0.1.0","r0.2.0","r0.3.0","r0.4.0","r0.5.0","r0.6.1","v1.0","v1.1","v1.2"],"unstable_features":{"org.matrix.e2e_cross_signing":true,"org.matrix.msc2285.stable":true,"org.matrix.msc2836":true,"org.matrix.msc3916.stable":true}}

[mserajnik]

Commenting this across a few related issue threads for visibility:

---

We upgraded our Synapse instance from a pre-1.11 spec version to the latest one yesterday.
Immediately we also hit this issue in Cinny (using the latest dev commit) where authenticated media requests are missing the Authorization header.

The Clear Cache & Reload button works, but it keeps seemingly randomly breaking afterwards, even with completely fresh browser sessions or different browsers that never had Cinny open before. The problem doesn't happen with Element, suggesting a bug with the MSC3916 implementation in Cinny.

According to a debug session with Claude, there might be a race condition with the service worker not being able to append the Authorization header in all cases. However, we weren't able to implement a working fix based on this knowledge, even with access token caching directly in the service worker and proactive token updates. We are also not sure if that is actually the problem, because once it breaks for one request it then breaks for all subsequent requests too, hinting towards a deeper issue (if it was a simple race condition, it shouldn't manifest itself for every single request after the first failed one).