Enable Optional Link Previews for Private Categories

Feature
1

I’d like to propose a new feature that could enhance usability for cases involving private categories: the ability to optionally enable automatic link previews (Oneboxes) for private topics/categories, even for users without explicit access.

Hello Discourse team and community,

What’s the problem?

Currently, Discourse blocks Onebox previews for topics located in private categories unless the user has direct access. While this is an effective security measure, it can impact workflows where users have a legitimate reason to reference private links inside their community.

For example:

  • Internal Communities: Sharing private topics (e.g., in team discussions) could benefit greatly from including basic metadata like the topic title or a snippet from the first post.
  • Cross-Team Communication: When teams collaborate but don’t have direct category access, previews could increase efficiency by reducing “blind references.”

Proposed Functionality

  • Add a site setting, such as allow_private_link_previews.
  • When enabled:
    • Links to topics in private categories would generate a preview containing only safe data (e.g., topic title, limited excerpt).
    • Permissions are respected: no full content exposure.
    • Links to the full topic would still go through normal access controls.

Privacy Considerations

Privacy and security should remain the default. When the setting is disabled, all current behaviors should persist. Even when enabled, sensitive or restricted data should never be included in previews.

Why this matters?

Discourse is a fantastic tool for fostering discussions. By enabling optional link previews for restricted content, users can maintain privacy while increasing clarity within teams or communities that rely on frequent referencing of private discussions.

This post was written with the assistance of an AI bot, making it collaborative in nature. Feedback, edits, or improvements are always appreciated, as the goal is to craft something that resonates with the needs of the Discourse community. :raised_hands:

Thank you for considering this!

P.S. I came across a related discussion: “Allow Private Categories to Onebox”. It explores a similar idea, focusing on improving Onebox functionality for private categories. Combining insights from both topics might help us arrive at a more robust solution.

4 Likes
2

It would be nice to have something like what GitHub Onebox Access Tokens setting has. It allows you to enter tokens from different private GitHub repositories, so Oneboxes can display the private data.

You could explicitly allow the user with access to your category to assign their api token on remote Discourse, so it would then access the data for Onebox on the source Discourse “officially” through the authenticated APIs.

Our use case: We have an internal company Discourse and then our customers also have Discourse. Both are private. But as some people have access to both, it would be great to be able to just paste links. And it would not reveal anything to the other users that wouldn’t be already described in the topic. So for example the customer’s Discourse has a documentation of the project. We store internal tasks about the project in our own Discourse. Mentioning our task in the discussion about the project makes it clear we are working on it and does not reveal anything bad to the customer. Really similar to the private GitHub workflow.

3 Likes