Question

我一直在研究由于CORS限制而无法在远程站点上呈现特定字体文件的问题。

到目前为止，我已经能够确定对该URL的请求正在使用access-control-allow-origin进行响应，但是nginx在远程进行时拒绝了对该字体的请求。

我使用的是来自spatie的laravel和laravel-cors插件，但我不认为这会返回不是从laravel路线呈现的样式表或字体的标题信息。

有人知道为什么会这样吗？

我的错误

Access to font at 'https://example.com/css/widget-icons/icomoon.ttf?wiodlm' from origin 'http://www.second-example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

通过curl检索的标题（似乎允许curl请求）

curl -I https://example.com/css/widget-icons/icomoon.ttf?wiodlm

HTTP/2 200 
date: Sun, 13 Jan 2019 16:57:34 GMT
content-type: application/x-font-ttf
content-length: 1316
set-cookie: AWSALB=r3yRudj6XwTlfaFzEdtxrecHzLLplOKlpRMbKuqL8InwUQYylNVFaZtmGHK2wQDgjvaXsBtRVcTCyjWidjTFUFmoDzKLBLH0gL6qarns38Qn4FuDNCZogawHtOjD; Expires=Sun, 20 Jan 2019 16:57:34 GMT; Path=/
server: nginx/1.14.1
last-modified: Tue, 25 Dec 2018 05:42:49 GMT
etag: "5c21c359-524"
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
access-control-allow-origin: *
accept-ranges: bytes

我的nginx配置为Access-Control-Allow-Origin（已设置为适当的区分大小写）。

location ~* .(gif|jpg|jpeg|png|ico|wmv|3gp|avi|mpg|mpeg|mp4|flv|mp3|mid|js|css|wml|swf|ttf|ttc|otf|eot|woff|woff2)$ {
        add_header Access-Control-Allow-Origin "*";
        expires max;
}

添加了模仿类型以通过ttf

application/x-font-ttf           ttc ttf;
application/x-font-otf           otf;
application/font-woff                            woff;
application/font-woff2           woff2;

Answer 1

在使CORS在Nginx +流明堆栈上正常工作时，我遇到了类似的错误。最终，我最终删除了用于启用CORS的nginx虚拟主机端配置，并使用自定义中间件来处理请求。我没有使用laravel-cors插件，但是为了进行测试，您可以尝试以下简单的解决方案：

<?php
namespace App\Http\Middleware;

use Closure;

class CorsMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next) {
        $headers = [
            'Access-Control-Allow-Origin'      => '*',
            'Access-Control-Allow-Methods'     => 'POST, GET, OPTIONS, PUT, DELETE',
            'Access-Control-Allow-Credentials' => 'true',
            'Access-Control-Max-Age'           => '86400',
            'Access-Control-Allow-Headers'     => 'Origin, Content-Type, Authorization, X-Requested-With'
        ];
        if ($request->isMethod('OPTIONS')) {
            return response()->json('{"method":"OPTIONS"}', 200, $headers);
        }
        $response = $next($request);
        foreach ($headers as $key => $value) {
            $response->header($key, $value);
        }
        return $response;
    }
}

Answer 2

我在使用 nextcloud 时遇到了问题。添加woff2就够了

   location ~* \.(?:svg|gif|png|html|ttf|woff|woff2|ico|jpg|jpeg)$ {
        try_files $uri /index.php$uri$is_args$args;
        # Optional: Don't log access to other assets
        access_log off;
   }

Answer 3

我通过将用于ttf的mime.types从application / x-font-ttf修改为font / ttf来解决了此问题。

我的Nginx配置

    location ~* .(js|css|ttf|ttc|otf|eot|woff|woff2)$ {
            add_header access-control-allow-origin "*";
            expires max;
    }

mime.types文件

mime.types edit. 
    application/x-font-ttf           ttc;
    application/x-font-otf           otf;
    application/font-woff2           woff2;
    font/ttf                         ttf;

为什么我的Nginx Web服务器不处理ttf字体？

3 个答案: