I'd like to create a ColdFusion page that handles [CORS](http://en.wikipedia.org/wiki/Cross-origin_resource_sharing) and serves fonts based on a URL param. So far I am able to download the font file, but the file is ~28KB (~15%) larger than the original. When I open it in Windows Font Viewer (Windows 7), I get the message **The requested file ... is not a valid font file.** So some junk must be getting added to the file as it passes through.

In this simplified example I have only one font and a directory `/fonts/icomoon/` which contains one `.ttf` font file.

The following code is the `index.cfc` file, and it is accessed w/ the url params `index.cfc?method=get&font=icomoon`.

```
<cfcomponent>

<cffunction name="get" access="remote" returntype="any">
    <cfargument name="font" type="string" required="true">
    <cfsetting showDebugOutput="No" enableCFoutputOnly="Yes">
    <cfscript>
        if (font eq "icomoon") var fn = "IcoMoon-Free.ttf";
        setFontHeaders(fn);
        setCORSHeaders([                // Optional
            "http://example.com",       // Example origins
            "http://stackoverflow.com"
        ]);
        include "fonts/icomoon/#fn#";
    </cfscript>
</cffunction>

<cffunction name="setFontHeaders" access="private" output="false">
    <cfargument name="filename" type="string" required="false" default="">
    <cfscript>
        var response = getPageContext().getResponse();
        response.setHeader("Content-Type", "application/x-opentype"); // See below
        if (arguments.filename neq "") {
            response.setHeader("Content-Disposition", 
                "attachment; filename=#arguments.filename#");
        }
    </cfscript>
</cffunction>

<cffunction name="setCORSHeaders" access="private" output="false">
    <cfargument name="whitelistOriginArray" type="array" required="true">
    <cfargument name="accessControlAllowMethods" type="string" required="false" 
        default="GET">      
    <cfscript>
        var response = getPageContext().getResponse();
        var headers = getHttpRequestData().headers;
        var origin = (StructKeyExists(headers, "Origin")) ? headers['Origin'] : '';
        if (ArrayFind(arguments.whitelistOriginArray, LCase(origin))) {
            response.setHeader("Access-Control-Allow-Origin", origin);
        }
        response.setHeader("Access-Control-Allow-Methods", 
            arguments.accessControlAllowMethods);
    </cfscript>
</cffunction>

</cfcomponent>

```

I tried... 

* all the Content-Types I could find, but that didn't seem to make a difference. (Source: [Proper MIME type for fonts](https://stackoverflow.com/questions/2871655/proper-mime-type-for-fonts))
* wrapping the content in `<cfprocessingdirective suppressWhiteSpace="true">`
* doing `savecontent variable="c" { include "fonts/icomoon/#fn#"; }; return c;` rather than just the `include`
* a bunch more stupid things, but to no avail

NOTE: The CORS functionality (`setCORSHeaders`) is optional and if left off the problem persists. I kept it in to avoid the question "Why go through ColdFusion at all and just include the original font file?".