You're correct. The immediate fix was to just upload the font but the long-term fix was as you pointed out. At first we would only treat urls with certain file

You're correct. The immediate fix was to just upload the font but the long-term fix was as you pointed out. At first we would only treat urls with certain file types (jpg, png, mp4, etc) as files when found on the server, the rest as pages and we switched from a whitelist of file types to anything that had an asset directory path in the url. Our original htaccess rules were definitely deficient. The idea was that we wanted tracking pixels and the like to be able to run code.