Q: How to get ttf from external domain without CORS problems I'm trying to get a .ttf to use in my web application from an external website. When I try it in this way:
@font-face {
  font-family: 'font';
  src: url('http://xxx.xyz/resources/tipografias/font.ttf') format('truetype');
}

I'm getting a CORS problem because of: 

No 'Access-Control-Allow-Origin' header is present on the requested
  resource.

I have tried with the jQuery showed by this website: Html5rocks
I have tried also with tomcat filters for CORS: CORS filter
And I have tries it with javascript too: Javascript
I don't know what I'm doing bad

A: If you control the external website and use htaccess you can use the following code to allow other websites to load your fonts:
<FilesMatch ".(eot|ttf|otf|woff)">
    Header set Access-Control-Allow-Origin "*"
</FilesMatch>

If you don't control the external website it's not possible to bypass the CORS policy.

I believe the following should work in your web.xml file:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
 <system.webServer>
   <httpProtocol>
     <customHeaders>
       <add name="Access-Control-Allow-Origin" value="*"/>
     </customHeaders>
   </httpProtocol>
 </system.webServer>
</configuration>


A: You can't bypass this - the server doesn't want you to have access to the font. As others have said, you could just download the font file and serve it locally. But that would likely be considered stealing. Depending on the font, it may be a specially licensed one.
If this is a 'font factory' (a company that designs and licenses fonts), then they likely will only allow licensed sites to access the font file (by checking whether the Origin request header your browser sends is on their list of allowed sites).
Side-note - CORS was basically invented specifically to stop people downloading fonts from font factories.
