title: Setting Access-Control-Allow-Origin on Cloudfront Cached Object
body: <p>Fonts served via Cloudfront are broken in Firefox due to the "<a href="https://stackoverflow.com/questions/15024333/downloadable-font-on-firefox-bad-uri-or-cross-site-access-not-allowed">bad URI or cross-site access not allowed</a>" issue. To fix this, I understand that I need to set the "Access-Control-Allow-Origin" header to a wildcard or the source domain. </p>
  
  <p>The problem that I am having is that <em>Cloudfront does not seem to be accepting headers from the origin</em>.</p>
  
  <p>For example, the following is the list of headers I get when I ping my server for the font:</p>
  
  <pre><code>curl -I -s "https://mysite.com/wp-content/themes/my-theme/includes/fonts/ProximaNova-Reg-webfont.ttf"
  HTTP/1.1 200 OK
  Server: nginx
  Date: Wed, 29 Jan 2014 16:03:03 GMT
  Content-Type: application/x-font-ttf
  Content-Length: 44992
  Last-Modified: Tue, 28 Jan 2014 22:21:41 GMT
  Connection: keep-alive
  ETag: "52e82d75-afc0"
  Expires: Thu, 29 Jan 2015 16:03:03 GMT
  Cache-Control: max-age=31536000
  Access-Control-Allow-Origin: https://mysite.com
  Access-Control-Allow-Methods: GET
  Access-Control-Max-Age: 3600
  Accept-Ranges: bytes
  </code></pre>
  
  <p>Everything looks good with this response; however, when I ping Cloudfront for the same resource, I get:</p>
  
  <pre><code>curl -I -s "https://ds6dj5kp03o39.cloudfront.net/wp-content/themes/my-theme/includes/fonts/ProximaNova-Reg-webfont.ttf"
  HTTP/1.1 200 OK
  Content-Type: text/plain
  Content-Length: 44992
  Connection: keep-alive
  Date: Wed, 29 Jan 2014 16:22:30 GMT
  Server: Apache/2.2.16 (Debian) mod_ssl/2.2.16 OpenSSL/0.9.8o
  Last-Modified: Wed, 22 Jan 2014 02:44:45 GMT
  ETag: "5d633-afc0-4f0861b87a140"
  Accept-Ranges: bytes
  Cache-Control: max-age=3600
  Expires: Wed, 29 Jan 2014 17:22:30 GMT
  X-Cache: Miss from cloudfront
  Via: 1.1 850e11212c3f83bfb138469e9b3b7718.cloudfront.net (CloudFront)
  X-Amz-Cf-Id: M4qkj9FwjdAUW91U4WeZzxEI0m7vOmiQvryS55WwoeU5Ks11IC71ig==
  </code></pre>
  
  <p>It seems that all of the origin headers are completely ignored. My question is, <strong>how do I get Cloudfront to accept my asset headers, especially the critical "Access-Control-Allow-Origin" header</strong>?</p>
  
  <p>Thanks for the help!</p>