Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add font-src:* in header for loading webfont by user css #392

Closed
wants to merge 1 commit into from

Conversation

fengkx
Copy link

@fengkx fengkx commented Jun 21, 2019

this pr add font-src in csp for loading webfont using stylus or stylish

@fguillot
Copy link
Member

From where do you load your fonts? What is stylus, a browser extension?

@fengkx
Copy link
Author

fengkx commented Jul 11, 2019

Yes, this kind of browser extension can inject some css into a page. So I can change font-family in my miniflux. This mean a lot for Chinese...

I inject this css to load fonts from google font

@import url('https://fonts.googleapis.com/css?family=Noto+Sans+SC:300,400,500,700&display=swap&subset=chinese-simplified,cyrillic,vietnamese');
.entry-content {
    font-family: 'Noto Sans SC', sans-serif;
    font-weight: 400;
    line-height: 32px;
    letter-spacing: .3px;
}

.entry-content blockquote {
    font-family: 'Noto Sans SC', sans-serif;
    font-weight: bold;
}

@somini
Copy link
Contributor

somini commented Sep 11, 2019

@fengkx
Copy link
Author

fengkx commented Sep 12, 2019

See openstyles/stylus#618 (comment)

The style can be install without modifying response header. But web font can't load from fonts.googleapis.com unless modifying the header.

@somini
Copy link
Contributor

somini commented Sep 12, 2019

Yes, but that's an open issue on Stylus itself, ultimately dependent on a Firefox bug.

https://bugzilla.mozilla.org/show_bug.cgi?id=1267027
https://bugzilla.mozilla.org/show_bug.cgi?id=1411641

At least that first bug had a comment a week ago.

It's cleaner to kindly prod those Firefox bugs than open the CSP for all Miniflux installations.


As a workaround, you can download that particular font file to the server running Miniflux and load it from there, CSP is valid in that case. @fguillot should know more about this.

@Crocmagnon
Copy link
Contributor

As a workaround, you can download that particular font file to the server running Miniflux and load it from there

You can also install the font on your system and just inject the CSS that uses it with Stylus. I already use this successfully on several websites to replace the monospace font they use.

@fengkx
Copy link
Author

fengkx commented Jun 17, 2020

You can also install the font on your system and just inject the CSS that uses it with Stylus

In fact, Miniflux now support custom css in setting. You don't need to use stylus. But external font will still be blocked by CSP

@fguillot
Copy link
Member

fguillot commented Jul 5, 2021

Closing out-of-sync and inactive pull-requests.

Feel free to resubmit this PR as long as you follow the guidelines.

@fguillot fguillot closed this Jul 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

4 participants