8

I've been trying to set up Amazon S3 as a webfont file host in order to use webfonts on Tumblr.

The CORS configuration suggested by Amazon works fine for everything except Firefox, which is exactly the same situation prior to Amazon enabling this new CORS feature in S3.

<?xml version="1.0" encoding="UTF-8"?>
<CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<CORSRule>
    <AllowedOrigin>http://fonttester.tumblr.com/</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
    <MaxAgeSeconds>3000</MaxAgeSeconds>
    <AllowedHeader>Authorization</AllowedHeader>
</CORSRule>
</CORSConfiguration>

Is there a different configuration I should be using?

Anthony
  • 141
  • 1
  • 4

1 Answers1

3

You have to add the below

<CORSRule>
    <AllowedOrigin>*</AllowedOrigin>
    <AllowedMethod>GET</AllowedMethod>
    <MaxAgeSeconds>3000</MaxAgeSeconds>
    <AllowedHeader>*</AllowedHeader>
</CORSRule>
rampr
  • 1,877
  • 4
  • 21
  • 36
  • 1
    Sorry, but that looks exactly the same as what I included in my original post, only without some extra lines that AWS S3 adds automatically. – Anthony Sep 07 '12 at 06:35
  • 2
    Why was I downvoted? Have you even tried it ? AllowedOrigin * allows requests from all domains. Specifically for fonts, in response to the OPTIONS request both AllowedMethod of GET and AllowedHeader * make sure fonts are loaded and MaxAgeSeconds specifies the time the response is cached. I use this and it works on my site - http://apps.facebook.com/sudokuquest/ – rampr Sep 08 '12 at 12:10
  • I didn't actually downvote you rampr, but your follow-up comment did expand on your first and so is more useful. Unfortunately however, it's still not working for me. I have only tested on Tumblr so far, so I'll try out some other domains, see if that might be a reason. – Anthony Sep 11 '12 at 06:51
  • 1
    I've tried it without success, it works for the preflight but not for the GET request. http://stackoverflow.com/questions/19505801/amazon-s3-cors-headers-only-show-during-options-preflight-and-not-during-get-r – reconbot Oct 21 '13 at 23:30