Wiki CDN/Base URL with XenForo 2.3 and Higher

Because browsers check the web site's CORS policy when loading SVG files, any site using the Wiki CDN URL, or a Wiki Base URL at a different domain or sub-domain from the main forum, will need to tweak their CORS policy in order to ensure that SVG icons are still rendered.

Issues are especially noticeable when using Firefox instead of Chrome, with Firefox giving an illogical and therefore unhelpful error message that a specific domain is not allowed by the Access-Control-Allow-Origin value even when it exactly matches.

When the Wiki Uses a Different Base URL

When an SVG icon is embedded directly in a page, browsers seem to mostly have a consistent behavior:
- The icon's Access-Control-Allow-Origin header must match the domain of the web page being viewed (for wiki content, the Wiki Base URL).

While the solution may seem simple, if your forum has a different base URL, you need to accommodate both.

When Wiki CSS Is Loaded from the CDN

Chrome checks that the SVG icon's Access-Control-Allow-Origin header matches the domain of the web page being viewed (see Wiki Base URL section above).

Firefox checks that the SVG icon's Access-Control-Allow-Origin header matches the domain where the CSS is located (Wiki CDN URL).

Resolving this Issue

Since you can only use a single Access-Control-Allow-Origin value per request, resolution is tricky.

Your web server must be configured to serve your SVG files with the value matching the Origin of the incoming request. Assuming you don't want to allow all domains (*), you would need to check the value of the Origin header against a whitelist that includes: the domain of your forum, the domain of your wiki, the domain of your wiki CDN, (any other theoretical domains/subdomains you may need to show the SVG on).

Your web server should also send a Vary header with a value of Origin, so that the browser will not check the domain against a cached copy of the SVG file if the browser is requesting the same file from a different domain than last time, because the cached domain would not match the current domain.