2

In this help site, Adobe recommends not setting CSP for web fonts saying:

The CSP policy does not allow you to set an exception for inline styles added by a script from a specific domain.

and

Adobe Fonts uses inline styles and fonts as data URIs to provide our service, and making exceptions for these negates a lot of the protection provided by a CSP.

What do they mean by it? And if my site already has CSP set, how do I use Adobe fonts if I shouldn't set CSP for it?

  • Because it wouldn't be beneficial to them to directly recommend to avoid using their web fonts. – Esa Jokinen May 19 at 11:04
1

The answer is actually a part of your question:

Adobe Fonts uses inline styles and fonts as data URIs to provide our service, and making exceptions for these negates a lot of the protection provided by a CSP.

As you see, Adobe does not follow best practices when it comes to security. If you would tweak your CSP in order to allow these things, you might not bother with CSP in the first place.

Is there no solution at all?

There could be. The strict-dynamic functionality in CSP 3 allows you to trust one script, which would then propagate its trust to those "child" scripts it creates.

If you are able to load Adobe's Web Fonts using strict-dynamic, then trust may be propagated to it without enabling inline scripts generally.

Why do I say "There could be" and not "The way to make it work is..."? Because I did not test this, so I can't say for sure.

  • Thanks @MechMK1. It's actually surprising that a company as seasoned as Adobe would do this. I'll look up strict-dynamic. I hope browser support for CSP 3 is wide. – eternaltyro Jul 4 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.