Your URLs should not change or end, and they must be valid until they are canceled, which can happen by updating the object or explicitly by invalidating the URLs in the firebase web console. At least as far as I know.
The first thing that comes to my mind is that you configured CORS on a bucket? This may be one of the reasons. check this
The second thing I can think of is storage rules. If you have something like allow read: if request.auth.uid == userId; , you can delete them to make the files public. You can use something like this to make all files in the path public:
service firebase.storage { match /b/XXXXXX.appspot.com/o { match /{allPaths=**} { allow read; } }
If you have already done these two things, then, unfortunately, this may be a mistake in firebase. Good luck
source share