# "blocked onebox domains" setting not respected
**URL:** https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479
**Category:** Bug
**Created:** [February 16, 2022, 9:35pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479 "2022-02-16T21:35:05Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@dschaper](https://meta.discourse.org/u/dschaper)
#### Post date: [February 16, 2022, 9:35pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/1 "2022-02-16T21:35:05Z")
`blocked onebox domains` are ignored in 2.9.0beta2 (c6265eec6b).
We have:
Those domains are behind OAuth walls and the onebox is trying to preview the domains and getting the OAuth login URL instead.
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [February 16, 2022, 11:01pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/2 "2022-02-16T23:01:11Z")
That setting only takes effect on the server — your browser will still attempt to do a onebox for the preview.
I can see how this might be unexpected.
If you submit the post, does it show the onebox after the server renders it, or does it show the bare URL as you expect?
---
### Author:  [@dschaper](https://meta.discourse.org/u/dschaper)
#### Post date: [February 17, 2022, 12:08am UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/3 "2022-02-17T00:08:44Z")
It shows as a onebox when the comment is posted:
---
### Author:  [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [February 17, 2022, 12:14am UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/4 "2022-02-17T00:14:54Z")
Yes, this doesn’t seem to be working properly… 😕
---
### Author:  [@nat](https://meta.discourse.org/u/nat)
#### Post date: [February 17, 2022, 1:09am UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/8 "2022-02-17T01:09:53Z")
Can you try adding “[auth.pi-hole.net](http://auth.pi-hole.net)” in your blocked onebox domains setting?
We’ve made this setting such that [it follows redirects](https://github.com/discourse/discourse/pull/15689) but only blocks the specified domain if it’s the final destination.
---
### Author:  [@dschaper](https://meta.discourse.org/u/dschaper)
#### Post date: [February 17, 2022, 1:15am UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/9 "2022-02-17T01:15:44Z")
Just tried and it still oneboxes it. I think because the [auth.pi-hole.net](http://auth.pi-hole.net) endpoint is a uri-redirect from the OAuth endpoint on [github.com](http://github.com). And we’d prefer not to block [github.com](http://github.com) from oneboxing.
Let me check and see if blocking github does anything…No, blocking [github.com](http://github.com) doesn’t preven oneboxing either. Is there a cache that onebox may be using that needs to be cleared so a new lookup is done for `tricorder`?
---
### Author:  [@nat](https://meta.discourse.org/u/nat)
#### Post date: [February 17, 2022, 1:55am UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/10 "2022-02-17T01:55:17Z")
> [@dschaper](#):
>
> we’d prefer not to block [github.com](http://github.com) from oneboxing
Yes I can understand why.
> [@dschaper](#):
>
> Is there a cache
There’s [a cache for one day](https://github.com/discourse/discourse/blob/a7d43cf1ec18fd7278926cc156529e3fefb721ab/lib/oneboxer.rb#L395) for fetched onebox URLs, so rebaking the post manually (`post.rebake!`) after one day would prevent the oneboxing with [github.com](http://github.com) blocked.
* * *
We have some work backlogged to be smarter about auth redirects, but that’s scoped to auth for Discourse forums only. I’m thinking perhaps expanding the setting to also allow subdirectories would help us with this case for github: [https://github.com/login/oauth/authorize](https://github.com/login/oauth/authorize) … Will discuss internally about this.
It’s probably also good to have the hint text be specific on what is actually blocked, perhaps an additional: “Onebox will follow redirects and block only if the final destination matches this setting”.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [February 17, 2022, 2:27am UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/11 "2022-02-17T02:27:07Z")
Wild idea… should we support:
`cache-control: no-store`
> **[Cache-Control header - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control)**
>
> The HTTP Cache-Control header holds directives (instructions) in both requests and responses that control caching in browsers and shared caches (e.g., Proxies, CDNs).
> The `no-store` response directive indicates that any caches of any kind (private or shared) should not store this response.
GitHub is specifically saying .. please … don’t store me …
Maybe onebox should respect it … and not store it.
We could always make this an experimental setting to start and see what impact it has.
The preview would have to explain why we are not oneboxing.
* * *
Note… we do use `no-store` in quite a few places, but I think we redirect in those cases, yet there is this slight complexity.
>
---
### Author:  [@dschaper](https://meta.discourse.org/u/dschaper)
#### Post date: [February 17, 2022, 8:15pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/12 "2022-02-17T20:15:55Z")
We do link to a lot of PRs and Issues from our various repositories and having those oneboxed with the previews helps newer users see what the topic is about without having to get in to GitHub.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [February 17, 2022, 8:56pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/13 "2022-02-17T20:56:18Z")
Yes totally get that, we are working on a solution, a day later I think looking at the no store header may be the best way forward
---
### Author:  [@dschaper](https://meta.discourse.org/u/dschaper)
#### Post date: [February 28, 2022, 7:57pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/14 "2022-02-28T19:57:27Z")
Sorry to bump this but it’s really affecting our support site. People post links to the tricorder URL that are troubleshooting logs for credentialed staff to look over. We get a number of these posts a day and we have to manually go in and change the URL to a non-link for now.
Any ideas on a timeframe to resolution or is it “soon™” 🙂
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [February 28, 2022, 8:21pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/15 "2022-02-28T20:21:37Z")
We will get this sorted, I would say some time in the next 4 weeks or so
---
### Author:  [@GreenOWL](https://meta.discourse.org/u/GreenOWL)
#### Post date: [March 10, 2022, 3:21pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/19 "2022-03-10T15:21:19Z")
How to do it in Discourse Docker? 🥺
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [March 11, 2022, 12:22am UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/20 "2022-03-11T00:22:21Z")
I recommend waiting on our fix to land, we have a PR in progress:
[https://github.com/discourse/discourse/pull/16150](https://github.com/discourse/discourse/pull/16150)
It amends the behavior so:
1. We do the blocklist checking on every hop in a redirect chain
2. We introduce a new feature so any site can opt out of oneboxing by setting a customer header
This will resolve @dschaper issue and give us more flexibility in future.
Unfortunately going with `no store` would cast a way too wide net and catch too many false positives.
---
### Author:  [@Osama](https://meta.discourse.org/u/Osama)
#### Post date: [March 11, 2022, 6:50am UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/21 "2022-03-11T06:50:43Z")
The PR has been merged and it’s in the `tests-passed` branch. Can you upgrade @dschaper and see if it fixes the problem? URLs with the `tricorder.pi-hole.net` domain should no longer onebox on your site.
---
### Author:  [@dschaper](https://meta.discourse.org/u/dschaper)
#### Post date: [March 14, 2022, 10:15pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/22 "2022-03-14T22:15:26Z")
Looks all good here!
Thanks for the fix everyone.
---
### Author:  [@nat](https://meta.discourse.org/u/nat)
#### Post date: [March 14, 2022, 10:52pm UTC](https://meta.discourse.org/t/blocked-onebox-domains-setting-not-respected/218479/23 "2022-03-14T22:52:18Z")