yes, unfortunately. however for nip05 its in the spec that it should be served with cors headers.
one hack that Vishalxl (npub1xg6…7kwr) thought of was just putting it in your github 😂 nostr:nevent1qqst77wldztdfzqtxm934sa3f9xjqlrsm3mpw289d6tgnk5dnfhszaq29a3gy