title: Locally hosted fonts breaking CSP rule
body: <p>I'm setting up <code>Content-Security-Policy</code> headers in <code>Nginx</code> and I am stuck at getting the locally hosted <code>Typekit</code> fonts to work.</p>
  
  <p>I'm using the following script for hosting <code>Typekit</code> fonts locally and the result has been very good with good load times and no FOUT: <a href="https://github.com/morris/typekit-cache" rel="noreferrer">https://github.com/morris/typekit-cache</a></p>
  
  <p>But now the problem is setting up CSP to pass these fonts. I tried localStorage but it didn't work.</p>
  
  <p>These are the errors I'm getting: </p>
  
  <blockquote>
    <p>[Report Only] Refused to load the font
    'data:font/opentype;base64,d09GMgABAAAAAFb0ABQAAAAAskgAAFaDAAIAAAAAAAAAAAAAA…bJbjfY7U6T320POPp5HLprLxRlPwIJqShhBB1pRCUKkQmIKRpGoiON1kre7lGR0Z4h5ENMAQAA'
    because it violates the following Content Security Policy directive:
    "font-src 'self'</p>
    
    <p>[Report Only] Refused to load the font
    'data:application/font-woff;base64,d09GRgABAAAAABwUAA4AAAAAKHQAAQAAAAAAAAAAA…NfJJTVolXlnco7lXdLiWW32CnmmMrFlnJ5aXLN8srxynGxmBgfv9d+AQ8KdggAAAABVwJMPAAA'
    because it violates the following Content Security Policy directive:
    "font-src 'self'</p>
  </blockquote>
  
  <p><em>(I removed the domains listed for the font-src policies).</em> </p>
  
  <p>Thank you</p>