Search code examples
csssecurityfontswebfonts

What are the security implications of using a web font hosted by a 3rd party provider?

What are the security implications of using a web font hosted by a 3rd party provider, such as Google or Adobe?

Solution

  • Google Fonts offers 3 methods of including their fonts on your page: through the link element, through the CSS @import statement and through external JavaScript.

    There should be no security problems if you include your stylesheet using the link element with a type attribute set to "text/css" or through the css @import statement; the browser would only attempt to read this as CSS and ignore anything which is invalid.

    There would be potential security risks in including the fonts through external JavaScript, but this all boils down to trust; do you trust Google or Adobe to host JavaScript for you?