Fast Google Fonts with Cloudflare Workers
blog.cloudflare.com
Fast Google Fonts with Cloudflare Workers
1–10 of 24 posts
Re: Fast Google Fonts with Cloudflare Workers
#2Maybe it's because I just skimmed the article, but what about the security implications of this? Doesn't dynamically loading third party ressources and serving them under your own domain open a whole can of worms?
Re: Fast Google Fonts with Cloudflare Workers
#3Maybe it's because I just skimmed the article, but what about the security implications of this? Doesn't dynamically loading third party ressources and serving them under your own domain open a whole can of worms?
Sure, but this is Google Fonts so if someone comprises that then they have access to many sites on the web.
I will say that this is probably overly complex and it would be easier to just download and serve the font files from your own domain instead. The CSS optimization isn't that necessary and is pretty much the same for all modern browsers.
Re: Fast Google Fonts with Cloudflare Workers
#4Couldn't you just download the Google fonts and serve them up yourself and use a Cloudflare rule to cache it on the edge, instead of going through all this work?
Re: Fast Google Fonts with Cloudflare Workers
#5Maybe it's because I just skimmed the article, but what about the security implications of this? Doesn't dynamically loading third party ressources and serving them under your own domain open a whole can of worms?
It's a tricky issue. I think you mean privacy implications,I don't see how this would add security risk.
For privacy,loading third party fonts like google fonts on your site allows the 3rd party(google) to track users. To avoid that,I try to load google fonts from my domain(and for performance when google is slow or unreachable). Arguably,if your site already uses google fonts,putting cloudflare between google and users reduces the amount of tracking users are exposed to. One might also say how privacy conscious site owners should avoid both google and cloudflare.
Re: Fast Google Fonts with Cloudflare Workers
#6Couldn't you just download the Google fonts and serve them up yourself and use a Cloudflare rule to cache it on the edge, instead of going through all this work?
And I wonder what speed tradeoff there will be for commonly cached/repeated fonts like Roboto, like maybe only makes since to inline less common fonts
Re: Fast Google Fonts with Cloudflare Workers
#7Couldn't you just download the Google fonts and serve them up yourself and use a Cloudflare rule to cache it on the edge, instead of going through all this work?
Sure! But note that Google serves different font formats depending on your user-agent, so you'll have to make sure to cover all the different formats and do your own user-agent matching. And keep it updated as user-agent capabilities change over time. It's not quite as easy as it sounds.
Re: Fast Google Fonts with Cloudflare Workers
#8Couldn't you just download the Google fonts and serve them up yourself and use a Cloudflare rule to cache it on the edge, instead of going through all this work?
Sure! But note that Google serves different font formats depending on your user-agent, so you'll have to make sure to cover all the different formats and do your own user-agent matching. And keep it updated as user-agent capabilities change over time. It's not quite as easy as it sounds.
[deleted]
Re: Fast Google Fonts with Cloudflare Workers
#9What about caching? The static font files have a really long cache age. You don't consider anywhere that the user might already have the font file.
Re: Fast Google Fonts with Cloudflare Workers
#10Maybe it's because I just skimmed the article, but what about the security implications of this? Doesn't dynamically loading third party ressources and serving them under your own domain open a whole can of worms?
It's a tricky issue. I think you mean privacy implications,I don't see how this would add security risk. For privacy,loading third party fonts like google fonts on your site allows the 3rd party(google) to track users. To avoid that,I try to load google fonts from my domain(and for performance when google is slow or unreachable). Arguably,if your site already uses google fonts,putting cloudflare between google and us…
To elaborate on how Google can track your users:
The user's browser downloads the font off of Google's server, which gives Google their IP address, and the browser also tells Google's server what webpage it's currently visiting, via the HTTP referer.
And given that almost every webpage ships something from Google, Google has an almost complete browsing history for every public IP. There's generally multiple devices behind one public IP, especially for corporate networks or VPNs, so they still have to demultiplex that with further tracking, e.g. Google Analytics, Chrome Sync, Android, but that's rarely a problem either, as even if you're carefully avoiding these, everyone else under your public IP using them would be enough to single you out.