Why don't web fonts in Firefox work on a different domain?

Question

I was experimenting with the fancy new OpenType font capability in Firefox 3.5 and I ran into a problem. I was trying to embed a font on a different domain than the page it would be used on, and it didn't work. I thought it may have been a bug, but from what I read on the MDC reference page, I noticed this note:

In Gecko, web fonts are subject to the same domain restriction (font files must be on the same domain as the page using them), unless HTTP access controls are used to relax this restriction.

It looks like they designed the browser that way on purpose. Out of curiosity, why would they do that? Is there any security risk with embedding a font? Or is it for legal trademark or copyright issues? Or something else?

Answer 1

If you want to bypass it you could try adding this to your .htaccess:

Header set Access-Control-Allow-Origin *

To answer your question, it's probably related to the fact that since version 3.5 Firefox supports the cross-origin sharing standard.