Repository: gratipay/gratipay.com

Issue:
Font problem in production
> Font from origin 'https://assets.gratipay.com' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://gratipay.com' is therefore not allowed access. 



Discussion:
We've seen this or something like it before. Do you remember this, @seanlinsley?

Just noticed this myself. It's causing the icons not to load:

![screen shot 2014-12-02 at 10 22 27 pm](https://cloud.githubusercontent.com/assets/197224/5275415/bbc8ca66-7a71-11e4-8203-4fe225a80e20.png)

`https://assets.gratipay.com` needs to have a header `Access-Control-Allow-Origin: *` in its responses for font files.

Reference: http://davidwalsh.name/cdn-fonts

I remember fixing this once by doing exactly what @colindean said.

Yes, but `*` later got changed to `gratipay.com`, and then I said "isn't that a no-op ?" so we removed it entirely, forgetting that assets are served from a subdomain in production.

This time leave a comment in the code so we know why it's needed.

This is pretty critical. Where is the commit that needs to be reverted?

+1 on [Twitter](https://twitter.com/FezVr4sta/status/542305197226459138)

This seems stalled. What is the next action?

Where is http://assets.gratipay.com/ configuration?

@techtonik The next step is someone stepping up with a PR to fix it. Want to do that? :-)

@techtonik Hint: check the git history for `gratipay/utils/cache_static.py`.

> @techtonik https://github.com/techtonik Hint: check the git history for
> gratipay/utils/cache_static.py.
> 
> At least! The entrypoint. =)

Good explanation of Access-Control-Allow-Origin is here:
http://stackoverflow.com/questions/10636611/how-does-access-control-allow-origin-header-work/10636765#10636765

The only question is where is the config of `https://assets.gratipay.com` ?
I don't think that any server has this kind of stuff enabled by default. The
requirement for Access-Control-Allow-Origin should be explicitly enabled, so
where is it done?

Ok. Looks like it is not server limitation, but browsers started
to enforce it. Ok. I forgot about same-origin-policy.

http://en.wikipedia.org/wiki/Same-origin_policy
https://developers.google.com/fonts/docs/troubleshooting

So the fix is to add `Access-Control-Allow-Origin:*`.
I don't think we need to restrict it only to `gratipay.com`
domain, because it may be handy for other domains, such
as `inside.gratipay.com`.


Resolving patch:
diff --git a/gratipay/utils/cache_static.py b/gratipay/utils/cache_static.py
--- a/gratipay/utils/cache_static.py
+++ b/gratipay/utils/cache_static.py
@@ -68,6 +68,9 @@ def add_caching_to_response(website, response, request=None, etag=None):
     # https://developers.google.com/speed/docs/best-practices/caching
     response.headers['Vary'] = 'accept-encoding'
     response.headers['Etag'] = etag
+    # Set CORS header for https://assets.gratipay.com (see issue #2970)
+    if 'Access-Control-Allow-Origin' not in response.headers:
+        response.headers['Access-Control-Allow-Origin'] = 'https://gratipay.com'
 
     if request.line.uri.querystring.get('etag'):
         # We can cache "indefinitely" when the querystring contains the etag.


Test patch: