Perhaps then, it could be a setting/header that we could opt-in-to, instead of having to opt out of, i.e., if I put the header there, then you obey it, but otherwise, you don't care?
Why we still had problems after adding "*": we have multiple codebases and have gone through a few iterations of how we serve assets for them, so each time we did it, we had to set up the correct headers again (you would think we would have learnt from the first time, but it's easy to forget these things), and since we keep accidentally starting with non "*", we then have to invalidate the cache on the CloudFront servers for those files, which takes a few hours. On Sat, Jan 5, 2013 at 2:16 AM, Robert O'Callahan <rob...@ocallahan.org>wrote: > One reason behind this is: what if you were using a font that wasn't free, > but had a license that required you to prevent deep-linking of the font > from other sites to where it's hosted on your site? Firefox and IE give you > a way to do that. Chrome doesn't. > > In this case, it's a free font so it doesn't matter, but of course the > browser doesn't know that ... unless you tell us via > Access-Control-Allow-Origin:*. > > BTW it's not clear to me why after adding Access-Control-Allow-Origin:*, > you still had problems. I assume it's an arcane detail of Web development > I'm blissfully ignorant of :-). > > Rob > -- > Jesus called them together and said, “You know that the rulers of the > Gentiles lord it over them, and their high officials exercise authority > over them. Not so with you. Instead, whoever wants to become great among > you must be your servant, and whoever wants to be first must be your > slave — just as the Son of Man did not come to be served, but to serve, > and to give his life as a ransom for many.” [Matthew 20:25-28] > _______________________________________________ dev-platform mailing list dev-platform@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-platform
