News for hackers. Stuff that matters.

A comment on Developers don't understand CORS.

Re:Developers don't understand CORS by martin_a on Thursday July 11, 2019 @08:59AM (#20411138)
At this point I don't want to understand CORS.

Put together a little script package this week, threw in some Vue and a Bootstrap and put it on our fileserver.

Now the Font Awesome icons won't load due to CORS errors.

I don't want to spin up a server for 500 lines of HTML/JS. I don't want to download the fonts, fiddle around in Bootstrap etc.

CORS is broken or the web itself has become broken if we need integrity checks and cross origin protection for using fonts.

[ Parent | on HN ]
Re:Developers don't understand CORS by yyyk on Thursday July 11, 2019 @10:56AM (#20411981)
Base64 should allow you to do it. It's logical to limit remote font loading, even moreso than js. There used to be quite a few RCE bugs involving fonts on Windows and Adove.
[ Parent | on HN ]
Re:Developers don't understand CORS by cooperaustinj on Thursday July 11, 2019 @09:09AM (#20411194)
Use a CDN!
[ Parent | on HN ]
Re:Developers don't understand CORS by martin_a on Thursday July 11, 2019 @09:18AM (#20411267)
So my scripts will randomly go down with the rest of the internet? Great idea!
[ Parent | on HN ]