python - Font from origin 'https://storage.googleapis.com' has been blocked from loading by Cross-Origin Resource Sharing policy -

background

• i running google app engine python using flask.
• i calling web assets in google cloud storage buckets via https://storage.googleapis.com/*

i can verify access-control-allow-originheader being set on request, per evidence below.

problem

how still following error in browser (chrome).

font origin 'https://storage.googleapis.com' has been blocked loading cross-origin resource sharing policy: no 'access-control-allow-origin' header present on requested resource. origin 'http://localhost:8080' therefore not allowed access.

code

i using flask snippet "decorator http access control", set origins below:

@admin_articles_routes.route('/xxx/xxx/xxx-xx') @crossdomain(origin="*") @authenticate_admin def edit_article(): 

-------- edit-----------

curl response vinays-macbook-pro:app-engine vinay$ curl -version http://localhost:8080/xxxx/xxxx/xxxx-xxxx?id=ahlkzxz-y2zjlw1lbgjvdxjuzs13zwjzaxrlcjbguygicagicagaom *   trying ::1... * connect ::1 port 8080 failed: connection refused *   trying 127.0.0.1... * connected localhost (127.0.0.1) port 8080 (#0) > /xxx/xxxx/xxxx-xxxxx?id=ahlkzxz-y2zjlw1lbgjvdxjuzs13zwjzaxrlcjelegdbcnrpy2xlihbbcnrpy2xlr3jhzhbhs2v5dassb0fydgljbguygicagicagaom http/1.1 > host: localhost:8080 > user-agent: curl/7.43.0 > accept: */* > referer: rsion >  < http/1.1 302 found < access-control-max-age: 21600 < location: http://localhost:8080/_ah/login?continue=http%3a//localhost%3a8080/xxxx/xxxxx/xxxx-xxxxx%3fid%3dahlkzxz-y2zjlw1lbgjvdxjuzs13zwjzbguygicagicagaom < access-control-allow-origin: * < access-control-allow-methods: head, < content-type: text/html; charset=utf-8 < cache-control: no-cache < expires: fri, 01 jan 1990 00:00:00 gmt < content-length: 575 < server: development/2.0 

this community wiki post of last answer provided greg.

the cors access-control-allow-origin header should returned host server accepting request, server sets rules can access own resources.

the cors options preflight headers set requester making request, identifies host server.

for more information, can see additional stack overflow post.