PHOTO;VALUE=URI:https://gateway.icloud.com/contacts/12345678901/ck/card/123
 456789abcd12345678abcd1234567

When Thunderbird is set to synchronize from an iCloud contact CardDAV, it is unable to show the photos for the contact. I am using TB 115 on Windows (problem is platform independent). =====Steps to reproduce===== # Have an Apple ID. Use [https://www.icloud.com/contacts/ iCloud contact]'s web UI to create a contact and upload a photo for them. # Get an app password for the Apple ID. # Add iCloud contact as a CardDAV address book in TB. Should use https://contacts.icloud.com/contacts/ as the carddav location. The actual carddav URL I got is something like https://p123-contacts.icloud.com/12345678901/carddavhome/card/. (not a real link) # Sync the address book. The photo would not display correctly. =====My investigation===== Apple's carddav API server returns in its vcard a HTTP URL as its PHOTO field, like: <pre> PHOTO;VALUE=URI:https://gateway.icloud.com/contacts/12345678901/ck/card/123 456789abcd12345678abcd1234567 </pre> (not a real url; you can export the vcard if you have done the above reproducing steps) However, this URL cannot be directly accessed (would return 401 saying "Missing X-APPLE-WEBAUTH-USER cookie"; see e.g. [https://github.com/MauriceConrad/iCloud-API/issues/44 this github issue]). However, the cookie is not really needed; I can use HTTP basic auth with the same credential for the carddav server (in this case it's the apple app password, <code>yourappleid@apple.com:1234-abcd-5678-dcba</code>). =====Potential fix===== The [https://github.com/mozilla/releases-comm-central/blob/658d2be2b789b3da8b2db7f5ac0f602b31a60613/mail/components/addrbook/content/aboutAddressBook.js#L3080C8-L3081 current implementation] directly puts the carddav photo URI into an HTML img tag. I think Thunderbird can make an AJAX request to fetch the image with the credentials and then put the result into an img tag.