I have a zip file of fonts. These fonts are referenced in a VF page that renders as text/css. (src:url({!URLFOR($Resource.ZipFile, 'fonts/OpenSans-Bold.ttf')});) The URL resolved to the correct font file, but I get a Cross-Origin Request Blocked issue.

The sub-domain for the static resource is different than the sub-domain for the Communities pages.

  • In Setup > Critical Updates, what is the status of "Serve Static Resources from the Visualforce Domain"? Jul 24, 2015 at 19:37

2 Answers 2


Perhaps there is a way to avoid the different domains for community pages but I don't know what it is. I have references like this in a Force.com Site named "eep":

<link href="{!URLFor($Resource.appzip, 'css/app.css')}" rel="stylesheet" />

that expand to a relative URL:

<link href="/eep/resource/1417007680000/appzip/css/app.css" rel="stylesheet">

and that just works.

If you can't fix it any other way (and if your font is accessible from the sub-domain of the Communities pages) you can build the URL yourself. The only tricky part is the timestamp, but one thing that works is to always use the current timestamp (System.currentTimeMillis() in Apex or new Date().getTime() in JavaScript) and that will return the latest version of the static resource.


The file needs to reside as static resource in your sandbox or production org The same basic org from which you have configured or setup communities Cross domain access is disallowed usually to prevent cross site scripting or clickjacking hacking attack The file cannot be accessed if stored in some other file system or server outside salesforce. Com

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .