Cross-Origin Request on docs webfonts

[KokaKiwi]

When I browse the Rust API docs with Firefox Nightly, the fonts aren't loaded and I have these errors on the console;

Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://rust-lang.org/fonts/Heuristica-Regular.woff. This can be fixed by moving the resource to the same domain or enabling CORS. Heuristica-Regular.woff
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://rust-lang.org/fonts/FiraSans-Regular.woff. This can be fixed by moving the resource to the same domain or enabling CORS. FiraSans-Regular.woff
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://rust-lang.org/fonts/Heuristica-Italic.woff. This can be fixed by moving the resource to the same domain or enabling CORS. Heuristica-Italic.woff
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at http://rust-lang.org/fonts/FiraSans-Medium.woff. This can be fixed by moving the resource to the same domain or enabling CORS. FiraSans-Medium.woff
downloadable font: download failed (font-family: "Heuristica" style:normal weight:normal stretch:normal src index:1): bad URI or cross-site access not allowed
source: http://rust-lang.org/fonts/Heuristica-Regular.woff main.css
downloadable font: download failed (font-family: "Fira Sans" style:normal weight:normal stretch:normal src index:1): bad URI or cross-site access not allowed
source: http://rust-lang.org/fonts/FiraSans-Regular.woff main.css
downloadable font: download failed (font-family: "Heuristica" style:italic weight:normal stretch:normal src index:1): bad URI or cross-site access not allowed
source: http://rust-lang.org/fonts/Heuristica-Italic.woff main.css
downloadable font: download failed (font-family: "Fira Sans" style:normal weight:500 stretch:normal src index:1): bad URI or cross-site access not allowed
source: http://rust-lang.org/fonts/FiraSans-Medium.woff

I'm using the latest Firefox Nightly (31.0a1)

[yuriks]

In addition, fonts are being loaded from http://rust-lang.org/, which currently simply timeouts, instead of http://www.rust-lang.org/ which works. This is probably a server configuration bug.

[yuriks]

The www issues seems to have been fixed today, but the CSRF problem remains. I'd like to note that this also happens with the regular Firefox release, not just in nightly.

[huonw]

cc @adrientetar @thehydroimpulse

[adrientetar]

Yes I noticed that Firefox does not like cross-origin (unlike Chrome), so my approach in my last PR was to upload the fonts locally on the built doc/ folder however there's a 403 forbidden status from the server at static.rust-lang.org, we would need to while-list to filetype – cc @brson.

[adrientetar]

@brson: the fix to allow webfonts consists of adding the following to .htaccess on the Apache server:

# ------------------------------------------------------------------------------
# | Web fonts access |
# ------------------------------------------------------------------------------

# Allow access to web fonts from all domains.

<IfModule mod_headers.c>
    <FilesMatch "\.(eot|otf|tt[cf]|woff)$">
        Header set Access-Control-Allow-Origin "*"
    </FilesMatch>
</IfModule>

(Only WOFF is required here.)

This code snippet comes from H5BP boilerplate configuration (it is a good default for servers).