The company that I work for have begun to block web fonts on external domains.

This creates a poor UX on most sites given that a large number of assets are generated through the likes of FontAwesome (as well as having to view 90% of websites in sans-serif).

What is the risk of allowing web-fonts to be downloaded and rendered by a web browser? It's the first time I've known a security team to take this measure.

  • 2
    Are they generally blocking web fonts or only if they are hosted on third-party domains? – Arminius Feb 10 '17 at 11:11
  • 1
    Yeah that's correct - if they're on third party domains that are not white-listed they're blocked; and there is not a very large number of sites on the whitelist. – Matt Feb 10 '17 at 11:13

Just like with any external resources, you're leaking a considerable amount of information to a third-party site if you're loading the external font in the background. These privacy concerns might be the main reason why they are whitelisting a few trusted sites.

Most notably, you're leaking the URL of the current site via the Referer header. Imagine a password reset page with a secret reset token in the URL that loads an external font - the token would immediately be leaked to that third-party service. (E.g., this bug report refers to this exact problem.) Even with non-secret content in the URL they would be able to collect usage statistics of your site by recording page visits, user-agent strings, etc.

Another threat of third-party fonts would be defacement (although you don't risk script injection which you would with external JS). If the third-party site was compromised, an attacker could modify the font in a way that would deface your website by changing how the caracters of that font are displayed. But even if you don't expect the site to be compromised you have to rely on their general availability. So if that site isn't a reliable CDN, I would consider hosting the font myself.

  • I understand that with regard to third party fonts. But what about with self-hosted fonts where there would be no cross-domain issues? I know the OP specified external fonts, but thought I'd ask anyway. – josh1978 Aug 8 '18 at 20:21

There are a number of privacy concerns regarding web fonts. When you put a link to a font in your page, you expose quite a lot of information to the site hosting the font and this may be particularly problematic for private sites.

The good news is that you can generally download the font file and serve it locally, that will also save a DNS lookup on your page, making things a little faster probably. Though check the terms of the license, you should be doing that anyway of course since not all "free" fonts are free for commercial use or allowed to be downloaded to your own servers.

There have, in the past, also been security issues related to fonts with the rendering engines being susceptible to a variety of hacks.

Here is a reference from another SO site: https://webmasters.stackexchange.com/questions/60464/are-there-privacy-considerations-in-using-google-web-fonts

  • It is worth making a distinction between blocking web fonts in a corporate firewall and including a third-party font in a website as a website developer. – northben Mar 8 '19 at 23:25

Web fonts can be blocked for security and privacy. One of the extensions on my Chrome actually has a setting to block webfonts for fingerprint protection.

If you know that a domain is whitelisted (ie Google Fonts host web fonts) then it's considered safe and most likely it's already cached into the client system to make download speeds fasted. There has been some attacks in the past (remote code execution) utilizing web fonts as an attack vector. However the frequency of such an attack is small and as mentioned, there are probably other ways to fingerprint you besides web fonts.

Ideally, from a user experience perspective, the web developer/designer should be using web fonts from trusted sources anyway like Google Fonts. Not only would it speed up web page browsing (if it's cached already) but it also serves a good purpose for those (corporate policies and individuals) that are privacy and security minded.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.