How does Google get around cross-site font protection in Firefox with its new Webfonts service?

Question

Google offers websites - http://code.google.com/webfonts

They work in Firefox, but FF has a security policy to stop the use of fonts between sites - http://hacks.mozilla.org/2009/06/beautiful-fonts-with-font-face/ (cross-site search Using a font.

Can anyone guess how they do it? Do they use "access control headers"? Is there any way to check this?

And are there any security issues when adding access control headers?

Thanks in advance.

Answer 1

Yes, they use access control headers. You can use Live HTTP Headers to check this:

• Go to the font page, for example: http://code.google.com/webfonts/family?family=Droid+Sans
• Click "Use this font."
• Go to href in the HTML snippet, for example: http://code.google.com/webfonts/family?family=Droid+Sans
• Enable direct HTTP headers
• Go to src from the CSS that you specified in step 3. This loads the font and you see Access-Control-Allow-Origin: * located in the response headers.