# Iframe onebox has stopped working
**URL:** https://meta.discourse.org/t/iframe-onebox-has-stopped-working/56091
**Category:** Support
**Created:** [January 20, 2017, 6:58pm UTC](https://meta.discourse.org/t/iframe-onebox-has-stopped-working/56091 "2017-01-20T18:58:57Z")
**Posts on this page:** 11
**Page:** 1
I’ve set up one of our organisation’s systems to provide a onebox using this HTML tag
As an example: on the page [https://domain.here/2345](https://domain.here/2345), I have this tag:
```plaintext
```
`https://domain.here/2345/oembed_json/` then provides
```plaintext
{"version": "1.0", "type": "rich", "html": "\u003ciframe src=\"https://domain.here/2345/embed/\" frameborder=\"0\" width=\"100%\" height=\"250\"\u003e\u003c/iframe\u003e"}
```
This used to work great, but has stopped working in the last few weeks (not sure exactly when). Currently on the latest version of Discourse, and I can reproduce the issue on meta. Oembed shows up fine on [Iframely URL Debugger - Open Graph, Twitter Cards, oEmbed](http://iframely.com/debug)
I’d rather not make the URL to the actual system public, but can PM it to someone if that would help.
---
I’ve setup a very simple example which displays the same issue. This URL should be oneboxing and becoming an iframe:
> **[Test Page to be embedded](http://discourse-test.taylorhq.co.uk)**
`http://discourse-test.taylorhq.co.uk`
Works [fine on the iframely debug tool](http://iframely.com/debug?uri=http%3A%2F%2Fdiscourse-test.taylorhq.co.uk%2F) and used to work fine on Discourse until about a month ago. Any ideas on what I can do to get this working again?
> **index.html**
>
> ```plaintext
>
>
> Test Page to be embedded
>
>
>
> This is a web page which has an application/json+oembed tag linking to Here
>
>
>
> ```
> **oembed\_json.json**
>
> ```plaintext
> {
> "type":"rich",
> "html":"\u003ciframe src=\"http://discourse-test.taylorhq.co.uk/embed.html\" frameborder=\"0\" width=\"100%\" height=\"250\"\u003e\u003c/iframe\u003e",
> "version":"1.0"
> }
>
> ```
> **embed.html**
>
> ```plaintext
>
>
> Test Page
>
>
> This is the page that should be displayed in the iframe
>
>
>
> ```
---
There are references to “rich” embeds with iframes in the “generic” onebox:
>
I believe the “whitelist” got removed fairly recently… could that be the issue? My site is no longer whitelisted?
---
> [@david](#):
>
> I believe the “whitelist” got removed fairly recently… could that be the issue? My site is no longer whitelisted?
I don’t think so. AFAIK the approach was changed from “don’t onebox unless whitelisted” to “onebox all the things unless blacklisted”
Conditional upon the “thing” being oneboxable of course.
---
I’ve finally tracked down the cause of this. It broke on 6th Jan, after this commit by @zogstrip
>
My iframe already has a fixed height, defined in pixels like this
```plaintext
```
The commit above added checks that `data[:height]` exists before accepting a ‘rich’ onebox… however, it’s not pulling that height from the parsed HTML, it’s trying to get it from the oembed JSON file. @zogstrip is this expected behaviour? Should I be defining the height of the iframe in the oembed JSON?
---
It’s weird looking back on support requests from before I joined the team 😂
What I said above is still true. You need to explicitly specify a height for the iframe in the oembed json. You now also need to add the iframe domain to the whitelist in site settings (In March 2017 this was not required). In summary, onebox doesn’t really support the [“rich oembed”](https://oembed.com/) specification too well.
Even in the spec, they have security concerns
> Consumers may wish to load the HTML in an off-domain iframe to avoid XSS vulnerabilities.
Given the lack of sites actually using rich oembed, I think it’s fine to leave things as-is.
---