Supporting tiktok urls for onebox

[david (David Taylor)]

@sam

Now that we have integrated onebox we should probably list exhaustively all the IFRAMEs we are allowing out of the box in a setting, so we call this out.

We have this data - it’s available in the site setting dropdown. OneBox engines are not allowed to render iframes unless they add the origin to the list first:

They add to the list via the requires_iframe_origins directive:

lib/onebox/engine/facebook_media_onebox.rb

If the associated origin is not enabled, then the Engine is automatically disabled.

@sam

I kind of feel like allowed onebox iframes should not be * out of the box, instead it should call out all the iframes we are allowing.

We could do that… but it would mean that new oneboxes will not automatically be added to the list.

Were you thinking of adding all the existing options? Or just a subset of the most common?