5

The company that I work for have begun to block web fonts on external domains.

This creates a poor UX on most sites given that a large number of assets are generated through the likes of FontAwesome (as well as having to view 90% of websites in sans-serif).

What is the risk of allowing web-fonts to be downloaded and rendered by a web browser? It's the first time I've known a security team to take this measure.

2
  • 2
    Are they generally blocking web fonts or only if they are hosted on third-party domains?
    – Arminius
    Feb 10 '17 at 11:11
  • 1
    Yeah that's correct - if they're on third party domains that are not white-listed they're blocked; and there is not a very large number of sites on the whitelist.
    – Matt
    Feb 10 '17 at 11:13
9

When your site uses external resources (often JS libraries or fonts via a CDN), your visitors may leak information to the third-party host as their browsers request the resources in the background. Privacy concerns about such leaks may be the reason for whitelisting a few trusted sites.

Most notably, the current URL can leak via the Referer header. Imagine a password reset page with a secret reset token in the URL that loads an external font – the token may be inadvertently revealed to that third-party via request header. (E.g., this vulnerability report refers to this type of problem.) Even with no secrets in the URL or other countermeasures like a Referrer-Policy, the content provider can still collect usage statistics for your site by recording page visits, user-agent strings, etc.

Another risk of using untrusted third-party fonts may be defacement (although not as severe as script injection via external JS). That is, if the provider was compromised, an attacker could modify their fonts in a way that changes the shape and appearance of the glyphs, effectively rewriting texts on your site. For this scenario, a solution can be hash verification (see Subresource Integrity).

But even if you don't expect an attack, remember you'll have to rely on the host's availability. So if they aren't a reputable CDN, you might consider self-hosting the files.

1
  • I understand that with regard to third party fonts. But what about with self-hosted fonts where there would be no cross-domain issues? I know the OP specified external fonts, but thought I'd ask anyway.
    – josh1978
    Aug 8 '18 at 20:21
6

There are a number of privacy concerns regarding web fonts. When you put a link to a font in your page, you expose quite a lot of information to the site hosting the font and this may be particularly problematic for private sites.

The good news is that you can generally download the font file and serve it locally, that will also save a DNS lookup on your page, making things a little faster probably. Though check the terms of the license, you should be doing that anyway of course since not all "free" fonts are free for commercial use or allowed to be downloaded to your own servers.

There have, in the past, also been security issues related to fonts with the rendering engines being susceptible to a variety of hacks.

Here is a reference from another SO site: https://webmasters.stackexchange.com/questions/60464/are-there-privacy-considerations-in-using-google-web-fonts

1
  • It is worth making a distinction between blocking web fonts in a corporate firewall and including a third-party font in a website as a website developer.
    – northben
    Mar 8 '19 at 23:25
3

Web fonts can be blocked for security and privacy. One of the extensions on my Chrome actually has a setting to block webfonts for fingerprint protection.

If you know that a domain is whitelisted (ie Google Fonts host web fonts) then it's considered safe and most likely it's already cached into the client system to make download speeds fasted. There has been some attacks in the past (remote code execution) utilizing web fonts as an attack vector. However the frequency of such an attack is small and as mentioned, there are probably other ways to fingerprint you besides web fonts.

Ideally, from a user experience perspective, the web developer/designer should be using web fonts from trusted sources anyway like Google Fonts. Not only would it speed up web page browsing (if it's cached already) but it also serves a good purpose for those (corporate policies and individuals) that are privacy and security minded.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.