Chrome not sending Authorization header for cross domain font requests
Reported by
b...@collage.co,
Sep 13 2017
|
||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.79 Safari/537.36 Example URL: Steps to reproduce the problem: 1. Protect website via HTTP basic 2. Host fonts on another domain (like a CDN) 3. Open webpage 4. Enter HTTP basic password for primary domain 5. Enter http basic for secondary CDN domain What is the expected behavior? Chrome sends authorization header for font requests coming from CDN domain What went wrong? No authorization header was sent Did this work before? N/A Chrome version: 61.0.3163.79 Channel: stable OS Version: OS X 10.12.5 Flash Version: Seems to be related to this closed bug. I commented there but no one was picking up on it. https://bugs.chromium.org/p/chromium/issues/detail?id=516192
,
Sep 19 2017
Thanks for reporting the issue. @bob-- Could you please provide us the sample url/sample test file to reproduce the issue and possible help us with the screencast of the steps , for better understanding. Thanks!
,
Oct 4 2017
I cant provide you the http basic credentials we are using at the moment because we are in the middle of a translation cycle and I won't be able to rotate them but I'll try to explain the issue in more details. We have a website hosted on a primary domain. The assets served from a CDN url that fronts the assets hosted on the primary domain. The Authorization header is forwarded from AWS Clourfront to the primary domain in order to be able request the asset. CORS headers are set up on the assets so cross site font requests should work. Everything works fine for scripts and images but the Authorization header is not sent for the font request.
,
Oct 4 2017
Thank you for providing more feedback. Adding requester "hdodda@chromium.org" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Oct 5 2017
As per C#3, Seems it is out of scope from TE end, adding TE-NeedsTraige-help label to move this out of our triaging bucket. Could someone from dev team please take a look into this issue. Thanks..!
,
Oct 5 2017
,
Oct 5 2017
This is working as intended. Web fonts are fetched with "Anonymous" CORS mode [1], meaning that credentials are not sent cross origin. [1] https://www.w3.org/TR/css-fonts-3/#font-fetching-requirements |
||||||
►
Sign in to add a comment |
||||||
Comment 1 by mmenke@chromium.org
, Sep 13 2017Components: -Internals>Network Blink>SecurityFeature