811888 - CORS issue with web fonts in live samples

Status: RESOLVED FIXED

(developer.mozilla.org :: Security, defect)

Description

[Eric Shepherd [:sheppy]]

When using live samples, we get errors like the following in the error log:

Timestamp: 11/14/12 4:43:34 PM
Error: downloadable font: download failed (font-family: "League Gothic" style:normal weight:normal stretch:normal src index:1): bad URI or cross-site access not allowed
source: https://developer.cdn.mozilla.net/media/fonts/League_Gothic-webfont.woff
Source File: https://developer.cdn.mozilla.net/media/css/mdn-min.css?build=52a92d9
Line: 0
Source Code:
@font-face {   font-family: "League Gothic";   font-style: normal;   font-weight: normal;   src: url("../fonts/League_Gothic-webfont.eot?") format("eot"), url("../fonts/League_Gothic-webfont.woff") format("woff"), url("../fonts/League_Gothic-webfont.ttf") format("truetype"); }

Comment 1

[Luke Crouch [:groovecoder]]

Jake we might need to add mdn.mozillademos.org to the list of allowable. But do we have mozillademos.(com|org|net) ? Or do we just have mozillademos.org?

Comment 2

[Jake Maul [:jakem]]

We only own/use .org.

I have added this on the Akamai side, but that's just referer checking. You also want to double-check the .htaccess file: https://github.com/mozilla/kuma/blob/master/media/fonts/.htaccess.

Looks like it needs a tweak to line 2. Something like this, perhaps:

SetEnvIf Origin "https?://(.*\.mozilla\.(com|org|net))" CORS=$0
SetEnvIf Origin "https?://(mdn\.mozillademos\.org)" CORS=$0

Or you could combine them into one line... just a slightly hairier regex:

SetEnvIf Origin "https?://((.*\.mozilla\.(com|org|net))|mdn\.mozillademos\.org)" CORS=$0

For readability it might be nice to have it split out. For performance, the leading .* is already pretty awful, so I'm not worried. :)

Comment 3

[Luke Crouch [:groovecoder]]

I think I have a fix ready for this, but want to test locally.

Sheppy - what's an example prod url with a sample that triggers this error?

Comment 4

[[github robot]]

Commits pushed to master at https://github.com/mozilla/kuma

https://github.com/mozilla/kuma/commit/1b3a667cd9cdaea3f460e0f52b4df71419857ae5
fix bug 811888 - add CORS for mdn.mozillademos.org

https://github.com/mozilla/kuma/commit/2d1391add0c956a947f6acbfe264c10b7048587f
Merge pull request #747 from groovecoder/samples-fonts-cors-811888

fix bug 811888 - add CORS for mdn.mozillademos.org

Comment 5

[Stephen Donner [:stephend] Not actively reading bugmail]

How do I verify this?

Comment 6

[Stephen Donner [:stephend] Not actively reading bugmail]

I think this looks good on https://developer.mozilla.org/en-US/docs/HTML/Element/marquee; can someone else verify?

I do see a mixed-content warning for [13:21:59.431] GET http://mdn.mozillademos.org/en-US/docs/HTML/Element/marquee$samples/Examples [HTTP/1.1 200 OK 62ms], but not sure if that's related or even matters?  I see the examples working.