如何在不让用户下载字体的情况下嵌入字体？
我知道这有点矛盾，因为浏览器必须下载字体才能呈现它，但我想知道是否有办法将其托管在无法直接下载的地方（或就此而言缓存到用户的计算机上） 。
我提出的一个解决方案是制作一个 PHP 脚本，将当前时间哈希到秒（添加盐）。如果 GET 请求中的特定变量与该哈希值匹配，那么它将发送出字体 MIME 类型的标头，然后输出字体文件的内容。
然后我会在样式表中重新创建哈希并连接字符串，这将是对 PHP 脚本的有效请求。
这就是基本的想法。我让它工作了。但这有两个缺陷：
- 如果浏览器在不同的时间请求字体，PHP 脚本将无法匹配哈希值，因此不会输出任何内容，因此字体将是备份字体（如果没有，则为默认字体）提供）
- 如果有人足够快，如果他/她在同一秒请求字体，他/她仍然可以直接下载字体（当然这可能必须是一个可以执行此操作的脚本。
浏览器也缓存字体吗任何地方（并不是说缓存会有所帮助，因为哈希值在URI 实际上总是不同的）
编辑：是否有我可以使用的 $_SERVER 变量？
I know this is a bit contradicting seeing as the browser would have to download the font to render it but I was wondering if there is a way to host it where that it cannot be directly downloaded (or cached onto a user's computer for that matter).
A solution I came up with was to make a PHP script that hashes the current time to the second (adding a salt). If a particular variable in the GET request matches this hash then it will send out the header for the font's MIME type and then output the contents of the font file.
Then I would recreate the hash in the stylesheet and concatentate strings where that it would be a valid request to the PHP script.
That's the basic idea. I had it working. But there were two flaws in this:
- If the browser requests the font on a different second, the PHP script would fail to match the hashes up, therefore, would output nothing thus the font would be the backup font (or the default font if none were provided)
- If someone were quick enough, he/she could still download the font directly if he/she requested it on the same second (granted this would probably have to be a script that would do this.
Also does the browser cache the font anywhere (not that the caching would help since the hash in the URI would practically always be different).
EDIT: Are there any $_SERVER variables that I could utilize?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
正如其他答案所说，对于真正想要下载它的人来说这是非常困难（不可能）的。几乎总是有办法的。但是，为了给您一些想法，这篇文章描述了Typekit如何处理这个问题。
As the other answers say, it's very difficult (impossible) against someone that really wants to download it. There is pretty much always a way. However, to give you some ideas, this article describes how Typekit handles the problem.
如果您希望浏览器可以使用该字体来显示您的页面，则必须允许以某种方式下载它。一旦它被放到网络上并发送到浏览器，用户将完全无法控制它要做什么。
你只能让它变得更难检索，而知识渊博的用户将轻松绕过你所做的任何事情。
If you expect the font to be useable by the browser for displaying your page, you MUST allow it be downloaded somehow. Once it's put onto the wire and sent to the browser, it is utterly out of your hands as to what the user will do with it.
You can only make it a bit harder to retrieve, and a knowledgeable user will bypass anything you do with trivial ease.
您可以像您的解决方案一样使其变得更加困难，但是如果您的目标是保护您的字体 IP，则它根本无法通过浏览器下载。无论您如何努力对抗专门的对手，您都无法控制浏览器的行为。
不过，您也许可以做的是提供服务器端代码来使用您的字体生成图像，并提供该图像。我假设您不想阻止用户看到该字体的渲染，而只是直接使用该字体？
You can make it more difficult, as your solution does, however if your goal is to protect your font IP, it simply cannot be downloadable by a browser. You cannot control what the browser does no matter how hard you try, against a dedicated adversary.
What you can do though, perhaps, is provide server-side code to generate an image using your font, and serve that image instead. I assume you're not trying to prevent the user from seeing the rendering of this font, just from using the font directly?