In this help site, Adobe recommends not setting CSP for web fonts saying:

The CSP policy does not allow you to set an exception for inline styles added by a script from a specific domain.


Adobe Fonts uses inline styles and fonts as data URIs to provide our service, and making exceptions for these negates a lot of the protection provided by a CSP.

What do they mean by it? And if my site already has CSP set, how do I use Adobe fonts if I shouldn't set CSP for it?

  • 2
    Because it wouldn't be beneficial to them to directly recommend to avoid using their web fonts. May 19 '19 at 11:04

Disabling CSP altogether is not recommended, but you do have a security impact by allowing inline styles. For example, you could use the following policy:

default-src 'self';
script-src 'strict-dynamic' 'nonce-rAnd0m123' 'unsafe-inline' http: https: 'report-sample';
style-src 'self' 'nonce-rAnd0m123';
object-src 'none';
base-uri 'none';
report-uri https://csp.example.com;

This would use 'strict-dynamic' for scripts, and would require you to add a nonce to every tag where Adobe Fonts wants to inject their webfonts. This may or may not be possible, depending on how Adobe Fonts works.

What is the worst that could happen?

If you really have to allow 'unsafe-inline' in your style-src directive, then you may open yourself up to CSS Injection, which may lead to stolen credentials. Of course, CSP should not your only defense against such things, so please don't see it as such.

What about the CSP directive on their website?

Adobe suggests the following CSP directive:

script-src 'self' use.typekit.net;
style-src 'self' 'unsafe-inline' use.typekit.net;
img-src 'self' p.typekit.net;
connect-src performance.typekit.net

The focus on whitelists suggests that this directive was added back when CSP was still very young and only whitelist-based approaches were possible. By using the 'nonce-' approach, you cam ensure that only the inline scripts loaded in specific locations are allowed.

  • Thanks @MechMK1. It's actually surprising that a company as seasoned as Adobe would do this. I'll look up strict-dynamic. I hope browser support for CSP 3 is wide. Jul 4 '19 at 15:16
  • strict-dynamic is only a valid CSP source for the script-src directive. Adobe requires unsafe-inline for the style-src directive.
    – thirdender
    Nov 8 '19 at 14:23
  • @thirdender I will update the answer accordingly.
    – MechMK1
    Nov 8 '19 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.