Configuring and troubleshooting oneboxes - Site Management - Discourse Meta
1 Like
^
I think “block onebox on redirect” is worth considering.
1 Like
Not if you can whitelist onebox domains.
Otherwise, yes, that’s an additional complication since the redirect could vary over time i.e. is safe at the time that the post is created but becomes unsafe subsequently, or even is conditionally safe all the time i.e. safe when the forum software itself does retrieval but is unsafe when an actual user does retrieval (easily detected on the server side via UserAgent unless UserAgent for actual user is carefully forged).
If onebox can’t be configured to be safe then it should, IMHO, just be disabled.
Even a safe re-implementation within Discourse of the underlying functionality is a little fraught. That is the bottom line: A forum and a forum user are presenting content in the forum “blind” i.e. the forum user doesn’t know or control what the onebox is going to contain, and the forum certainly doesn’t. (For understanding, onebox scrounges page metadata that the forum user will not have seen.)
1 Like