title: access-control-allow-origin (CORS) Amazon CloudFront
body: <p>I am trying to set up Amazon CloudFront that it works well.
  Everything works fine, exept for <code>access-control-allow-origin "*"</code></p>
  
  <p>I added inside my .htaccess file the following:</p>
  
  <pre><code> &lt;ifModule mod_headers.c&gt;
   &lt;FilesMatch \.(eot|ttf|otf|svg|tif|tiff|woff)$&gt;
     Header set Access-Control-Allow-Origin "*"
   &lt;/FilesMatch&gt;
   &lt;/ifModule&gt;
  </code></pre>
  
  <p>And checking the file direclty on the server, it works fine:</p>
  
  <pre><code>curl -I https://domain.com/fonts/font.woff
  </code></pre>
  
  <p>I get the result <code>Access-Control-Allow-Origin: *</code></p>
  
  <p>But when I check it for the Amazon CloudFront url, it does not work. It is not added to the header.</p>
  
  <p>I also added the "Origin" to the whitelist, see:</p>
  
  <p><a href="https://i.stack.imgur.com/CrZJI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/CrZJI.png" alt="enter image description here"></a></p>
  
  <p>But it still does not work, it is not added to the header.</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>When I create a new .woff file and load it over CloudFront <code>Access-Control-Allow-Origin: *</code> is still not edit. So I still miss something, what am I missing?</p>
  
  <p>See my header:</p>
  
  <pre><code>HTTP/1.1 301 Moved Permanently
  Content-Type: text/html; charset=iso-8859-1
  Content-Length: 0
  Connection: keep-alive
  Date: Fri, 23 Dec 2016 08:05:32 GMT
  Server: Apache/2
  Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
  Location: https://domain.com/fonts/font_2.woff
  Cache-Control: max-age=2592000
  Expires: Sun, 22 Jan 2017 08:05:32 GMT
  Age: 21
  X-Cache: Hit from cloudfront
  Via: 1.1 9635c619f121d7a236fe1312f20e5f1b.cloudfront.net (CloudFront)
  X-Amz-Cf-Id: Ygkldos5hh6s5AwolxfL5nzoxsNJPl-vpmeoNZ8fEGSKPVCgzbIFtg==
  </code></pre>
  
  <p>What am I missing?</p>
  
  <p><strong>EDIT 2:</strong></p>
  
  <p>Looks like it is because of my current https redirect in .htaccess. See: </p>
  
  <pre><code>RewriteCond %{HTTPS} off
  RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  RewriteCond %{HTTP_HOST} !^www\.
  RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  </code></pre>
  
  <p>How to solve this?</p>