Thanks for jumping in so quickly @chriscoyier!
This happens when I try to onebox the link using the gem, the request is being done from Ruby’s Net::HTTP
.
The flow is:
- Fetch Codepen’s HTML (e.g. GET to https://codepen.io/web-tiki/full/dNpgrR).
- Discover the oEmbed URL from the
application/json+oembed
header tag. - Fetch oEmbed data and build the box.
We never reach step number 2.
Onebox can also work outside of Discourse since it’s a standalone gem, so I don’t think we can rely on a referrer. On the other hand, we could possibly set a specific user-agent that can be allowed on your side? (Is this acceptable, @sam?)