Allow sub-domains from blocked domain to onebox

Product Support

AI-generated summary

Allow Sub-domains from Blocked Domain to Onebox

The discussion revolves around the issue of oneboxing links from a specific domain (replit.com) and its sub-domain (ask.replit.com). Firepup650 initiated the conversation, stating that the main site fails to onebox, while the sub-domain works fine.

Lilly mentioned that it’s not possible to allow sub-domains to onebox while blocking the top domain, citing a meta discussion.

JammyDodger suggested that the issue might be related to the image used on Replit pages. Canapin provided a script for Replit oneboxes and found that the link is transformed into an empty iframe.

anon44628144 shared a temporary solution that worked only once, allowing oneboxing for the sub-domain but not the main site. Firepup650 discovered that explicitly allowing Replit iframes resolves the issue.

Further investigation by Firepup650 revealed that the data-unsanitized-src attribute in the iframe code is the culprit. Changing it to src solves the problem, as demonstrated in this topic.

1

On a site I help run, we’ve recently found that a certain site fails to onebox (becomes a large empty space). We would have just blocked the domain from oneboxing, but that breaks oneboxing the forum hosted at a sub-domain of that site. Is it possible for us to allow the sub-domains to onebox without allowing the top domain to onebox?

2

For example, this main-site onebox fails (https://replit.com/@Firepup650/Yeehaw):
https://replit.com/@Firepup650/Yeehaw
But the subdomain (Discourse) is fine (https://ask.replit.com/t/my-intro-i-guess/20705):
https://ask.replit.com/t/my-intro-i-guess/20705

3

unfortunately i don’t think that is possible as per this topic

4

There seems to be something off with the link that creates the giant blank space. In the preview I notice it tries to give a big ‘Replit’ logo image. Could it be that the image used on those type of pages is breaking the onebox? Sorting that out may help them resolve nicely.

5

There’s a specific script for Replit oneboxes:

When we paste a Replit link, the composer shows the expected result:

image
image1476×634 18.1 KB

When the post is processed, the link is transformed into an empty iframe.

<iframe width="695" height="521" frameborder="0" data-unsanitized-src="https://replit.com/@Firepup650/Yeehaw?embed=true" seamless="seamless" sandbox="allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-presentation">
#document
  <html>
    <head></head>
    <body></body>
  </html>
</iframe>

I don’t know if the issue comes from Replit or from the onebox script. I’d guess it’s the script, but I’m no coder :slight_smile:

The link has proper opengraph tags, though: https://developers.facebook.com/tools/debug/?q=https%3A%2F%2Freplit.com%2F%40Firepup650%2FYeehaw

6

I actually got it to work so that Discourse would not onebox replit.com but would onebox ask.replit.com. For some reason that only worked once though. After that it just blocked all oneboxing on both domains. Odd.

image
image991×351 40.4 KB

I help run the same forum as Firepup

7

After explicitly allowing Replit iframes, the following iframe code (Which seems similar to what @Canapin posted) works fine:

<iframe frameborder="0" width="500px" height="500px" src="https://replit.com/@Firepup650/Yeehaw?embed=true"></iframe>
8

Manual testing confirms that this specific part of the iframe is the issue. Changing it to just src works as expected (See third post on this topic)