# Gyfcat Onebox Bug

**URL:** https://meta.discourse.org/t/gyfcat-onebox-bug/35916
**Category:** Bug
**Created:** [November 22, 2015, 8:44pm UTC](https://meta.discourse.org/t/gyfcat-onebox-bug/35916 "2015-11-22T20:44:06Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [November 23, 2015, 11:38am UTC](https://meta.discourse.org/t/gyfcat-onebox-bug/35916/4 "2015-11-23T11:38:13Z")

</div>

I just looked into it, this issue is only occuring on SSL enabled instances because of a change introduced by Gfycat.

Gfycat is no longer serving iframe content (in oEmbed) over secure connection (`HTTPS`), hence SSL enabled Discourse instances are giving following error when trying to onebox Gfycat link:

```plaintext
Mixed Content: The page at 'https://meta.discourse.org/t/gyfcat-onebox-bug/35916/3' was loaded over HTTPS, but requested an insecure resource 'http://gfycat.com/ifr/FirsthandMeekAfricanaugurbuzzard'. This request has been blocked; the content must be served over HTTPS.

```

oEmbed URL: [http://gfycat.com/cajax/oembed/FirsthandMeekAfricanaugurbuzzard](http://gfycat.com/cajax/oembed/FirsthandMeekAfricanaugurbuzzard)

The proper fix for this is that Gfycat should be serving iframe over HTTPS. I will try to bring this issue in their notice.

The last option would be to create a custom Gfycat onebox, where I will have to force the Gfycat iframe URL to be served over HTTPS.

---

_[View the full topic](https://meta.discourse.org/t/gyfcat-onebox-bug/35916)._