requests for stylesheet css info to fonts.googleapis.com get blocked missing Access-Control-Allow-Origin header

[GoogleCodeExporter]

i'm using web font loader which generates the following css code and embeds 
into the DOM

<link rel="stylesheet" 
href="http://fonts.googleapis.com/css?family=Open+Sans%7CDroid+Sans%7CTahoma">

(this bug happens even without using web font loader, css directly)

The problem is that it gets blocked by every browser with status "403 Forbidden"

The reason is because fonts.googleapis.com does not send a 
Access-Control-Allow-Origin header 

where as if font is accessed directly via themes.googleusercontent.com the 
server does return Access-Control-Allow-Origin header 

seems to be a bug and maybe easily fixed by adding the 
Access-Control-Allow-Origin header by fonts.googleapis.com

Original issue reported on code.google.com by lbarenb...@gmail.com on 1 Aug 2012 at 4:11

[GoogleCodeExporter]

Could you provide a youtube video that shows this? :) I believe that the 
Access-Control-Allow-Origin header is only needed for the font files, not the 
CSS. 

Original comment by dcrossland@google.com on 3 Aug 2012 at 1:58

[GoogleCodeExporter]

here's a youtube video.  i tried both chrome and firefox:

http://youtu.be/Xyx6Y-lPRF4?hd=1

Original comment by lbarenb...@gmail.com on 3 Aug 2012 at 5:05

[GoogleCodeExporter]

I think i just figured out what's going on. the fonts that the code was getting 
were: 'Open Sans', 'Droid Sans', 'Tahoma'

if tahoma is removed from the list, everything is fine and the css loads.

still it's strange that 403 is generated when request is done by the website 
but when the link is used directly in the browser, everything is find and the 
whole css, including Tahoma is loaded.

Original comment by lbarenb...@gmail.com on 3 Aug 2012 at 5:12

[GoogleCodeExporter]

Okay great, thanks!

Original comment by dcrossland@google.com on 3 Aug 2012 at 5:45

• Changed state: Invalid