4 ms·

"One is so that you can use fonts that have single-site licenses in a way that satisfies the licensor, by not allowing other sites to use the font too without y

"One is so that you can use fonts that have single-site licenses in a way that satisfies the licensor, by not allowing other sites to use the font too without your authorization." Good point but I believe that the only way to combat that particular edge-case is to use something like the valid_referers directive: https://gist.github.com/jdorfman/6737413 https://gist.github.com/jdorfman/6737413 "This isn't about a known attack, but a class of attack that we know from experience is likely to crop up in the future for any type of cross-origin resource load that we allow." You bring up another good point, but I am not talking about every cross-origin resource here, I am talking about Content-Type: font/ttf, application/x-woff, application/vnd.ms-fontobject & image/svg+xml.

mbrubeck 13y ago
Note: We can't actually restrict cross-origin requests based on Content-Type, since we don't know the Content-Type until we get a response. But, that quibble aside, I agree that allowing cross-origin requests just for @font-face does not open up any obvious holes. (If it did, Chrome and Safari users would be under attack already.) However, it is the sort of thing that creative hackers are good at combining with other capabilities or exploits in order to get at data or code they shouldn't. The trend in web API design is to keep things same-origin by default, and give control to authors over whether they want to give other origins access to their data, because this keeps things secure by default and limits the number of tools that those creative hackers have at their disposal. Not everyone at Mozilla agrees that this is the right solution. Anne van Kesteren (formerly of Opera, now a Mozilla employee), for example, favors adding a "From-Origin" request header that would remove the need for servers to add Access-Control-* headers in many cases (though it would not provide the same security properties by default): http://annevankesteren.nl/2011/02/from-origin http://annevankesteren.nl/2011/02/from-origin http://www.w3.org/TR/2011/WD-from-origin-20110721/ http://www.w3.org/TR/2011/WD-from-origin-20110721/ Meanwhile, some Google employees have been major proponents of making things same-origin by default; read the Tab Atkin post linked above for example. This isn't really about sides; it's about constantly trying to find better ways to improve the web without compromising security. I won't claim the current solution is perfect; it's a starting point, that's all.
- jdorfman 13y ago
  I think PG put it best back in 2000: http://www.amazon.com/gp/cdp/member-reviews/A3OCCXOG34ECBC/ref=cm_pdp_rev_title_2?#R1MXJ1KGMFKP6A http://www.amazon.com/gp/cdp/member-reviews/A3OCCXOG34ECBC/r... Thanks for the debate, I learned a lot. =)

mbrubeck 13y ago

Note: We can't actually restrict cross-origin requests based on Content-Type, since we don't know the Content-Type until we get a response. But, that quibble aside, I agree that allowing cross-origin requests just for @font-face does not open up any obvious holes. (If it did, Chrome and Safari users would be under attack already.) However, it is the sort of thing that creative hackers are good at combining with other capabilities or exploits in order to get at data or code they shouldn't. The trend in web API design is to keep things same-origin by default, and give control to authors over whether they want to give other origins access to their data, because this keeps things secure by default and limits the number of tools that those creative hackers have at their disposal. Not everyone at Mozilla agrees that this is the right solution. Anne van Kesteren (formerly of Opera, now a Mozilla employee), for example, favors adding a "From-Origin" request header that would remove the need for servers to add Access-Control-* headers in many cases (though it would not provide the same security properties by default): http://annevankesteren.nl/2011/02/from-origin http://annevankesteren.nl/2011/02/from-origin http://www.w3.org/TR/2011/WD-from-origin-20110721/ http://www.w3.org/TR/2011/WD-from-origin-20110721/ Meanwhile, some Google employees have been major proponents of making things same-origin by default; read the Tab Atkin post linked above for example. This isn't really about sides; it's about constantly trying to find better ways to improve the web without compromising security. I won't claim the current solution is perfect; it's a starting point, that's all.

jdorfman 13y ago
I think PG put it best back in 2000: http://www.amazon.com/gp/cdp/member-reviews/A3OCCXOG34ECBC/ref=cm_pdp_rev_title_2?#R1MXJ1KGMFKP6A http://www.amazon.com/gp/cdp/member-reviews/A3OCCXOG34ECBC/r... Thanks for the debate, I learned a lot. =)