Whitelist to allow onebox only with https domains?

Ah, thank you so much for the clarification.I was mis-understanding the process used for displaying the images pasted as urls into a message (I’d assumed this was still a part of the onebox process)

So If I understand this correctly now, you’re saying that anytime I paste an image url from a site (say imgur), it pulls it and self hosts on my server (i.e. not a hotlink)?

What I’m trying to avoid are mixed content warnings/error messages from security audits of the site - currently users are pasting links without the https , even though their domain does have a valid ssl cert. I assumed that these were hotlinking, and thus causing the mixed content error messages