THTheAceOfHearts·Dec 30, 2018
I really like the typeface, so I hope this comment won't come off as too negative. In the FAQ the author mentions that you can fetch the typeface directly from his site. I'd advise against relying on third-parties without contractual obligations to you in production.
If you decide to take this risk anyway then you should take steps to reduce the risk of future security issues. The most important thing is to use use Subresource Integrity [0] on your <link> tags. However, since the author doesn't provide versioned URLs (the query strings are only being used to bust the cache, not to select which file is served), this would likely cause your site to break on each release. Usually CDNs give you a URL which includes the version as part of the path.
Another issue is that SRI only checks top level resources, there's no equivalent for external fo
Read the rest
nts and images which get included from the stylesheet [1]. It doesn't seem like the largest attack vector, but you never know what kinds of browser bugs might pop up.
Finally, Cache-Control has a max-age of 4 hours. If you don't expect these resource to change then you'd want the value to be way longer.
[0] https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
[1] https://github.com/w3c/webappsec-subresource-integrity/issue...