search

nfl / jquery-oembed-all

A fork with improvements of the jquery-oembed project
141 stars 58 forks source link

URL Expanding doesn't work on HTTPS sites #35

Open mgoodfellow opened 8 years ago

mgoodfellow commented 8 years ago

Unfortunately, the URL expanding doesn't work on HTTPS sites due to Same Origin Policy. The URL expanding services don't offer HTTPS access to their API, so the ajax request will be blocked by the browser.

See an explanation on stackoverflow

The effect of this is that (for example) shortened youtube (youtu.be) URLs will not be embedded correctly if your site runs on HTTPS.

One solution is to proxy the calls via another service (in our case we are using our servers to do this), thereby meaning we adhere to Same Origin Policy, and it is also an HTTPS call.

An enhancement to the library (which I plan to PR soon) would be to have the URL expanding service to be configurable, due to different API implementations, possibly using a callback would be the best method.

petertwise commented 6 years ago

For youtu.be in particular, just remove it completely from the list of url shorteners. The youtube regex works fine for this without a 3rd party expander. see https://github.com/starfishmod/jquery-oembed-all/pull/123