Whitelist Typography.com fonts

[arajay]

Typography.com is a custom font provider. Their basic licensing agreement prohibits the download of their custom fonts; the only option for font embedding (without paying a hefty licensing fee) is to link to their cloud hosted stylesheet.

Example:
<link rel="stylesheet" type="text/css" href="//cloud.typography.com/6256354/724768/css/fonts.css">

This is a request to whitelist Typography.com CDN for serving fonts to AMP clients.

Is this possible? Or would it require each individual stylesheet URL to be whitelisted in the AMP CSP, as indicated by the response to this request?

[cramforce]

Absolutely possible. Steps:

• whitelist in validator
• update CSP

@arajay Are you with typography.com?

[arajay]

I do not work for typography.com but many of my clients use their CDN hosted fonts; in the meantime I have been using alternate web-safe fonts for my AMP pages instead.

[Gregable]

Do you know what the range of possible URLs here would be?
Would https://cloud\.typography\.com/[0-9]*/[0-9]*/css/fonts.css work?

[arajay]

Affirmative @Gregable ; the stylesheet links for all my clients are formatted in that manner.

[cramforce]

@arajay Could you try to get somebody from typography.com to comment here. Many font providers do referrer checking which may require additional work for AMP.

[arajay]

"Sarah," a representative from Typography.com replied to my request with: "We do not allow for the white listing of domains."

[cramforce]

I'm not sure what that means :)

So, lets go ahead here.

@Gregable I think just going for the prefix https://cloud.typography.com/is fine.

[Gregable]

Closing, but will be a little while longer before it's released.

[cramforce]

I assume we still need to make the CSP change, right?

Sending you a CL.

[cramforce]

New CSP

content-security-policy:default-src * data:; script-src https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com; report-uri https://csp-collector.appspot.com/csp/amp

[Gregable]

This is now live everywhere.

[lannka]

We saw a bug that
cloud.typography.com is doing a 302 redirect to a different domain, and the css is then blocked by CSP.

See example.

It works fine on the canonical page, but has problem on CDN.

Filed a separate bug here: #5844