Tighten CORS rules around fonts

[data-sync-user]

┆Issue is synchronized with this Jira Task

[data-sync-user]

Daniel Miranda commented from Jira:

Our rules are currently set to:

{code:json}[
{
"AllowedHeaders": [
""
],
"AllowedMethods": [
"GET",
"HEAD"
],
"AllowedOrigins": [
"https://.accelevents.com",
"https://*.mozillafoundation.org"
],
"ExposeHeaders": [],
"MaxAgeSeconds": 3000
}
]{code}

I think we could tighten these up in three ways:

Empty out AllowedHeaders — since we're only serving fonts/images via GET, browsers don't send custom headers that need pre-approval, so a wildcard isn't necessary.

Replace subdomain wildcards with specific origins — {{.accelevents.com}} and {{.mozillafoundation.org}} cover any subdomain Locking these down to exact origins reduces risk.

Drop HEAD from AllowedMethods

Updated rules would look like:

{code:json}[
{
"AllowedHeaders": [],
"AllowedMethods": [
"GET"
],
"AllowedOrigins": [
"https://",
"https://mozillafoundation.org"
],
"ExposeHeaders": [],
"MaxAgeSeconds": 3000
}
]{code}

[~accountid:712020:df1d02fe-5a82-4cf2-9e6c-62a9af785923] can we please go over this during our 1:1 and I can implement this if it looks good? thanks!

[data-sync-user]

Rob DiVincenzo commented from Jira:

[~accountid:62fd85ffbb0704a2a8094628] sounds good, thanks for the heads up!