"Pulling a font for a domain"—wtf, isn't the client making the request? Why dete... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		alabastervlog 10 months ago \| parent \| context \| favorite \| on: You wouldn't steal a font "Pulling a font for a domain"—wtf, isn't the client making the request? Why detect anything, just require a referrer on your allow-list, and deny if it's not there.

badmintonbaseba 10 months ago [–]

An allow-list would probably suck for local development for users that do have a valid license.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact