CSS downloaded font blocked in Firefox ("Content Blocked Source")

Question

Firefox (52.6) is refusing to download a font and giving the error "Content Blocked Source". The same page works fine in Chrome. The error is:

downloadable font: download failed (font-family: "Myfont" style:normal weight:normal stretch:normal src index:0): content blocked source: http://example.com/test/Myfont.ttf

The CSS code looks like this:

       @font-face {
           font-family: 'Myfont';
           src: url('Myfont.ttf') format('truetype');
       }

The font is present in the /test directory. When Chrome loads this page, it requests the font and receives and displays it correctly.

The web site itself is a very simple HTTP web site run on Apache. There is no third party content, no active content, no Javascript, no HTTPS. The CSS is embedded in the HTML page (index.html). There is no separate CSS file. The server is obviously serving the font, since Chrome can display it. If I try to download just the font in Firefox it works. In other words, the following URL works in Firefox:

http://example.com/test/Myfont.ttf

This is the exact same URL that Firefox is reporting as "Content Blocked" when it is accessed via CSS @font-face.

I also tried moving everything to the root directory, both font and index.html and it made no difference. Works in Chrome. Does not work in Firefox.

In my client, I changed security.fileuri.strict_origin_policy to FALSE, and it still does not work, so it is not an origin problem.

CORS probably...it doesn't have an http**s** link? – Paulie_D Jan 24 '18 at 15:17 — Paulie_D, Jan 24 '18 at 15:17
@Paulie_D It is a plain HTTP web site. – Tyler Durden Jan 24 '18 at 15:37 — Tyler Durden, Jan 24 '18 at 15:37

score 2 · Answer 1 · answered Jan 25 '18 at 00:50

After working on this problem all day, I finally figured out what it was: NoScript. The NoScript add on actually does more than block JavaScript. One of its default options is to block @font-face:

Go to Tools/AddOns (Ctrl+Shift+A) NoScript Options to turn it off.

score 1 · Answer 2 · answered Jan 24 '18 at 15:17

1

is it possible that you are serving the page over https, but the font URL is http? not sure why that would work in chrome, as mozilla's pages suggest they moved in line with chrome behaviour in such circumstances, but might be worth looking into

answered Jan 24 '18 at 15:17

Brickers

182
1
12

It is a plain HTTP web site, there is no green padlock. – Tyler Durden Jan 24 '18 at 15:36
have you checked whether any addons are interfering? – Brickers Jan 24 '18 at 15:44
also, it looks like other sources in the page that are https could be causing the issue as shown [here](https://stackoverflow.com/questions/47536960/got-blocked-loading-mixed-active-content-on-http-website) – Brickers Jan 24 '18 at 15:46

CSS downloaded font blocked in Firefox ("Content Blocked Source")

2 Answers2