turt2live / matrix-dimension

An open source integration manager for matrix clients, like Element.
https://dimension.t2bot.io
GNU General Public License v3.0
432 stars 110 forks source link

Twitch widget reports it does not work #409

Open webpigeon opened 3 years ago

webpigeon commented 3 years ago

PLEASE NOTE: make sure the bug exists in the latest patch level of the project. For instance, if you are running a 2.x version of Apostrophe, you should use the latest in that major version to confirm the bug.

To Reproduce

Step by step instructions to reproduce the behavior:

  1. Create a twitch widget in a room using dimension
  2. Enter a channel name
  3. Observe that the widget states, "Whoops! This embed is misconfigured."
  4. Open the developer tools to observe the error message
Twitch embed error message:
[NoParent] parent query string value was not specified

Docs: https://dev.twitch.tv/docs/embed/video-and-clips/

Expected behavior

The widget should display twitch things

Describe the bug

There seems to be a missing URL parameter and twitch reports it's not there.

Details

Version of Node.js: No idea, up to date docker-ansible-matrix-deploy

Server Operating System: Docker: yes (ubuntu host)

Additional context: I've tested this in self-hosted element (web) and desktop element.

Screenshots If applicable, add screenshots to help explain your problem.

Screenshot from 2021-04-11 19-51-21

Screenshot from 2021-04-11 19-51-37

TheTimeWalker commented 2 years ago

It seems like this won't be as trivial to fix as first thought.

Trying to add the parent url would instead clash with the frame ancestors security header:

Refused to frame 'https://player.twitch.tv/' because an ancestor violates the following Content Security Policy directive: "frame-ancestors http://localhost:* https://localhost:*".

There are some examples that could be useful: https://github.com/BarryCarlyon/twitch_misc/tree/main/player/electron But I fear that this would mean we'd have to make the Twitch widget more special than it is right now