- From: Tab Atkins <tabatkins@google.com>
- Date: Thu, 10 Feb 2011 16:14:09 -0800
- To: David Singer <singer@apple.com>
- Cc: "Levantovsky, Vladimir" <Vladimir.Levantovsky@monotypeimaging.com>, Sylvain Galineau <sylvaing@microsoft.com>, Håkon Wium Lie <howcome@opera.com>, John Daggett <jdaggett@mozilla.com>, "public-webfonts-wg@w3.org" <public-webfonts-wg@w3.org>, Anne van Kesteren <annevk@opera.com>
On Thu, Feb 10, 2011 at 4:07 PM, David Singer <singer@apple.com> wrote:
> On Feb 10, 2011, at 15:56 , Levantovsky, Vladimir wrote:
>> I think this could be a very good alternative to CORS. "From Origin" header would work exactly as proposed if present. However, the default behavior can be specified by the WOFF spec that in absence of "From Origin" header must be treated as if "From Origin: same" is set. In my admittedly 'under-educated' opinion, this would resolve all the concerns that Håkon and Anne had presented (i.e. the same "From Origin" header can be used with any other media type "without causing havoc"), and the only difference is that the alternative default behavior is specified by WOFF spec.
>>
>> As Håkon said, if "From Origin" can be spec'ed quickly, this might be the way to eliminate the dependency on CORS.
>>
>> Comments?
>
> I think there may be some opposition to a type-specific rule (e.g. "for files with the type WOFF"), and some discussion of the alternative link-specific rule ("for files linked from CSS font-face"). My understanding is that at least some of the current implementations of CORS/SOR are in fact, not type-specific but link-specific.
Yes, both IE and Firefox are link-specific - everything going through
@font-face has SOR, regardless of format.
~TJ
Received on Friday, 11 February 2011 00:14:40 UTC