249887 2022-12-25 14:10:39 -0800 preloading local file with "crossorigin" leads to the file not being loaded at all 2023-08-17 05:36:52 -0700 1 1 1 Unclassified WebKit Page Loading Safari 16 All All NEW https://bugs.webkit.org/show_bug.cgi?id=236009 InRadar P2 Normal --- 86817 1 kalle.wachsmuth webkit-unassigned achristensen annevk beidson cdumez mmaxfield webkit-bug-importer youennf oldest_to_newest 1921899 0 464209 kalle.wachsmuth 2022-12-25 14:10:39 -0800 Created attachment 464209 example HTML document Issue encountered here: https://github.com/rust-lang/rust/issues/98769 The problematic preload link looks like this: <link rel="preload" as="font" type="font/woff2" crossorigin href="SourceSerif4-Regular.ttf.woff2"> crossorigin is apparently needed for preloading fonts (https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types/preload#cors-enabled_fetches). The issue arises when the file to be loaded is on the local machine (file:/// URLs). This doesn't work in conjunction with crossorigin. Dev console: [Error] Origin null is not allowed by Access-Control-Allow-Origin. Status code: 0 [Error] Failed to load resource: Origin null is not allowed by Access-Control-Allow-Origin. Status code: 0 (SourceSerif4-Regular.ttf.woff2, line 0) Failing to preload a local file isn't much of a problem, but attempting to fetch the font later (it's being pulled in from CSS) will then also fail. As a result, the preload link prevents the font from being loaded at all. ## Reproducing Safari 16.2 (18614.3.7.1.5) / macOS 13.1 on x86-64 Example font: https://github.com/rust-lang/rust/raw/298d763fc0ac206cf3ae202459101e36a17071f7/src/librustdoc/html/static/fonts/SourceSerif4-Regular.ttf.woff2 Example HTML document is in the attachments Put them both in the same folder and open the document. serif font --> success sans-serif font --> failure The same thing works fine in Firefox 108.0.1 for example 1922456 1 webkit-bug-importer 2023-01-01 14:11:15 -0800 <rdar://problem/103802172> 1922529 2 annevk 2023-01-02 07:56:00 -0800 It sounds like this is further fallout from us not using CORS for font fetches. 464209 2022-12-25 14:10:39 -0800 2022-12-25 14:10:39 -0800 example HTML document preload-bug.html text/html 464 kalle.wachsmuth PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KCTxzdHlsZT4KCQlAZm9udC1mYWNlIHsKCQkJ Zm9udC1mYW1pbHk6ICJTb3VyY2UgU2VyaWYgNCI7CgkJCWZvbnQtc3R5bGU6IG5vcm1hbDsKCQkJ Zm9udC13ZWlnaHQ6IDQwMDsKCQkJc3JjOiBsb2NhbCgiU291cmNlIFNlcmlmIDQiKSwgdXJsKCJT b3VyY2VTZXJpZjQtUmVndWxhci50dGYud29mZjIiKSBmb3JtYXQoIndvZmYyIik7CgkJCWZvbnQt ZGlzcGxheTogc3dhcDsKCQl9CgoJCWJvZHkgewoJCQlmb250LWZhbWlseTogIlNvdXJjZSBTZXJp ZiA0Iiwgc2Fucy1zZXJpZjsKCQl9Cgk8L3N0eWxlPgoJPGxpbmsgcmVsPSJwcmVsb2FkIiBhcz0i Zm9udCIgdHlwZT0iZm9udC93b2ZmMiIgY3Jvc3NvcmlnaW4gaHJlZj0iU291cmNlU2VyaWY0LVJl Z3VsYXIudHRmLndvZmYyIj4KPC9oZWFkPgo8Ym9keT4KCTxoMT5UZXN0ITwvaDE+CjwvYm9keT4K PC9odG1sPgo=