This is probably due to CORS (or not quoting paths) and is expected behaviour. I know it sounds confusing, but the reason is due to the source of your fonts and not the web page itself.
A good explanation and numerous solutions for Apache, NGINX, IIS or PHP available in multiple languages can be found here:
https://www.hirehop.com/blog/cross-domain-fonts-cors-font-face-issue/