Serving Font from CDN – Dealing with CORS

Serving static files from CDN is a good practice. Unfortunately, if you are trying to serve font files from a different domain, then you might see broken glyphs on Firefox or Internet Explorer browsers. While this works perfectly in Webkit based browsers (Google Chrome), latest Firefox and IE have security implementation which blocks such services.

But the problem to this solution is pretty straight forward. All you need to do is add proper Access Control Origin header.

Adding the header to your CDN server

Your CDN server might be running any kind of web server application. We are going to talk about the most popular ones, Apache and Nginx.

Adding header to Apache Server:

Edit .htaccess or /etc/apache2/apache.conf and add the following line:

[text]
# Apache config
<FilesMatch ".(eot|ttf|otf|woff)">
Header set Access-Control-Allow-Origin "*"
</FilesMatch>
[/text]

Adding header to Nginx Server:

In your virtual host file (usually located at /etc/nginx/sites-available/default) add the following code

[text]
location ~* \.(eot|otf|ttf|woff)$ {
add_header Access-Control-Allow-Origin *;
}
[/text]

If you can not add header on your CDN:

There are some CDNs like Amazon S3 (at the time of writing) which would not let you add any header information. In such case, the best way is to serve the font files and font CSS file from your own domain instead of the CDN.

More Information on the issue:

More information can be found at the following links:

Swashata has written 257 articles

Hi there, I am the Lead Developer at WPQuark.com. I love to create something beautiful for WordPress and here I write about how to use them. When I am not working, usually I am doing a number of other creative things ;).

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

This site uses Akismet to reduce spam. Learn how your comment data is processed.