# Impossible d'empêcher les oneboxes de x.com (et elles sont cassées)

**URL:** https://meta.discourse.org/t/impossible-to-prevent-x-com-oneboxes-and-theyre-broken/397516
**Category:** Bug
**Tags:** onebox
**Created:** [Mars 3, 2026, 8:51 UTC](https://meta.discourse.org/t/impossible-to-prevent-x-com-oneboxes-and-theyre-broken/397516 "2026-03-03T08:51:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [Mars 3, 2026, 8:51 UTC](https://meta.discourse.org/t/impossible-to-prevent-x-com-oneboxes-and-theyre-broken/397516/1 "2026-03-03T08:51:27Z")

</div>

- Ajouter `x.com` et `twitter.com` au paramètre du site `blocked_onebox_domains`
- Créer une nouvelle publication
- Entrer un lien vers [x.com](http://x.com) sur sa propre ligne
- Voir comment vous obtenez une (cassée) onebox

 ![image](https://global.discourse-cdn.com/meta/original/4X/5/4/5/545602397d6247f02125a83073241d3f450311fb.png)

Que la onebox soit cassée ou non ne dépend pas de la valeur du paramètre du site `blocked_onebox_domains`. Elles sont toujours cassées.  
HTML généré, voyez comment pratiquement tout est vide.

```plaintext
<aside class="onebox twitterstatus" data-onebox-src="https://x.com/The_Kremlinn/status/2028700091154940405">
  <header class="source"><svg class="fa d-icon d-icon-fab-twitter svg-icon fa-width-auto svg-string" width="1em" height="1em" aria-hidden="true" xmlns="http://www.w3.org/2000/svg"><use href="#fab-twitter"></use></svg>

      <a href="https://x.com/The_Kremlinn/status/2028700091154940405" target="_blank" rel="noopener">x.com</a>
  </header>

  <article class="onebox-body">
    
<h4><a href="https://x.com/The_Kremlinn/status/2028700091154940405" target="_blank" rel="noopener"></a></h4>
<div class="twitter-screen-name"><a href="https://x.com/The_Kremlinn/status/2028700091154940405" target="_blank" rel="noopener">@</a></div>

<div class="tweet">
  <span class="tweet-description"></span>
</div>

<div class="date">
  <a href="https://x.com/The_Kremlinn/status/2028700091154940405" class="timestamp" target="_blank" rel="noopener"></a>

</div>

  </article>

  <div class="onebox-metadata">
    
    
  </div>

  <div style="clear: both"></div>
</aside>

```

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [Mars 25, 2026, 1:33 UTC](https://meta.discourse.org/t/impossible-to-prevent-x-com-oneboxes-and-theyre-broken/397516/2 "2026-03-25T13:33:44Z")

</div>

Sera corrigé par

> <https://github.com/discourse/discourse/pull/38868>
>
> Two issues with Twitter/X oneboxes:
> 
> 1. Adding \`x.com\` or \`twitter.com\` to \`bl…ocked\_onebox\_domains\` had no effect. In \`FinalDestination#resolve\`, domains in the \`ignore\_redirects\` list (which includes x.com, twitter.com, youtube.com, etc.) trigger an early return with \`:resolved\` status before \`blocked\_domain?\` is ever checked. This made it impossible to block oneboxes for any of these domains. The fix adds the blocked domain check before the \`ignore\_redirects\` shortcut in \`resolve()\`.
> 
> 2. When X/Twitter returns no useful Open Graph metadata (which is the current real-world behavior without API credentials), the onebox rendered an empty shell — an \`\<aside\>\` with blank title, empty tweet div, and no timestamp. \`TwitterStatusOnebox\` had no field validation unlike other engines (e.g. \`AmazonOnebox\`). The fix adds a \`verified\_data\` method that requires \`title\` and \`tweet\` to be present, returning empty HTML when they're missing. This causes Discourse to fall back to a plain link instead of rendering a broken onebox.
> 
> https://meta.discourse.org/t/397516