Google Fonts with CSP Foundry
The Google Fonts preset is selected. Two directives are involved because the stylesheet and the font files come from different hosts.
- Select Google Fonts and look at the style-src and font-src lines in the generated policy.
- Copy the policy and deploy it as Report-Only.
- Open a page that uses the fonts and confirm nothing is reported.
- Consider self-hosting the fonts to remove the third-party dependency.
What to know
Google Fonts needs two origins. The stylesheet link points at https://fonts.googleapis.com, which is a style-src (more precisely style-src-elem) concern. The actual font files are downloaded from https://fonts.gstatic.com, which is a font-src concern. If you only allow one, the text renders in a fallback font and the console shows a second error for the other.
A frequent surprise is a blocked stylesheet error that mentions default-src: if you have a default-src but no style-src, the browser applies default-src to stylesheets, and the error says so. Add style-src with your own origin plus fonts.googleapis.com, instead of widening default-src.
Self-hosting the font files removes both third-party entries and the privacy question of fonts being fetched from Google by your visitors. If you do that, 'self' is enough for both directives, and the stylesheet error about default-src disappears along with the third-party requests.
Updated · Cosmovex
Questions
What CSP do I need for Google Fonts?
style-src https://fonts.googleapis.com for the stylesheet and font-src https://fonts.gstatic.com for the font files, alongside 'self'.
Why are my fonts not loading with CSP?
Usually only fonts.googleapis.com was allowed, or only fonts.gstatic.com. Both are needed, in style-src and font-src.
Can I allow Google Fonts through default-src?
You can, but it widens every fetch directive. Prefer adding exact style-src and font-src entries.
Is self-hosting fonts better for CSP?
It is simpler: 'self' covers both directives and you drop two third-party origins.
The free plan covers everything on this page. CSP Foundry Pro ($9/mo, billed monthly) is described on the CSP Foundry page.
