CSP – Font load error

Hi,

i uploaded the font open-Sans to my server with your import option in the themes. Then i activated the font in the settings.

Then i set a CSP policy that fonts have to be loaded only from local storage (‘self’).

In Safari i get an error in the webconsole to any page:

Refused to load data:application/font-woff;charset=utf-8;base64,d09GRgABAAAAAGYMAA4AAAAAowAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAABRAAAABwAAAAcckwii0dERUYAAAFgAAAAHwAAACABMwAET1MvMgAAAYAAAABAAAAAYJYFacxjbWFwAAABwAAAAUEAAAKi6kAXkmdhc3AAAAMEAAAACAAAAAj//wADZ2x5ZgAAAwwAAFnuAACMgOFsk4doZWFkAABc/AAAAC4AAAA2DP0UgmhoZWEAAF0sAAAAGgAAACQPogeuaG10eAAAXUgAAAEHAAACFodAcgtsb2NhAABeUAAAAg4AAAIO/oLadm1heHAAAGBgAAAAHwAAACABWQC1bmFtZQAAYIAAAAGbAAADVi8qdoNwb3N0AABiHAAAA+cAAApGwPo//ndlYmYAAGYEAAAABgAAAAayr1bhAAAAAQAAAADMPaLPAAAAANMHHI4AAAA…9ztdmYrdl7b3JHyR0ld5TcUarkuafknpJ7Su4puafknpJ7Su4puaeU5Lmr5K6Su0ruKrmr5K5Slue+kvtK7iu5r+S+UpbnzpI7S+4sua9sf7mn7302ixlmbTZma/Zysz1me8z2mO0x22O2x2yP2R6zPWZ7zPaY7THbY7bHbI/ZHrM9ZnvM9pjtMdtjtsdsj9kesz1me8z2mO0x22O2x2yPWV9zX5/6mos8vc1Fnv5m/c2ll1d8X/reR49ZmcnMZjHDrM3GlKPnpfa8nhc9L3pe9LzoedHzouelkaPvRd+Lvhd9L/pe9L3oe9H3ou9F34u+F30v+l70veh7aeW18lp5rbyOvI68jryOvI68jryOvI68jrxOLy/8fgn9CP0I/Qj9CL0IvQi9CL0IvQi9CL0IvQi9CL0IvQi9CL0IvQi9CL0IvQi9CL0IvQi9CL0IvQi9CL0IvQh9CH0IfQh9CH0IfQg9CD0IPQg9CPcf7j9K8y+BQLz/AAABVuGyrgAA because it does not appear in the font-src directive of the Content Security Policy.

So the theme try to load a font again from another source then mine…

How can we fix it?

Firefox: Content Security Policy: Die Einstellungen der Seite haben das Laden einer Ressource auf data:application/font-woff;charset=utf-8… blockiert (“font-src”).

My htaccess:

Header set Content-Security-Policy “default-src ‘self’; frame-src ‘self’; font-src ‘self’; img-src *; script-src ‘unsafe-inline’ ‘unsafe-eval’ https: *; style-src ‘self’ ‘unsafe-inline’ https: *; media-src ‘self’ https://www.youtube.com/; form-action ‘self’;”

FIXED:

data: musst be declared on CSP

Header set Content-Security-Policy “default-src ‘self’; frame-src ‘self’; font-src ‘self’ data:; img-src *; script-src ‘unsafe-inline’ ‘unsafe-eval’ https: *; style-src ‘self’ ‘unsafe-inline’ https: *; media-src ‘self’ https://www.youtube.com/; form-action ‘self’;”

• This topic was modified 6 years, 5 months ago by Pako.