# Internal oneboxing problem revisited
**URL:** https://meta.discourse.org/t/internal-oneboxing-problem-revisited/65735
**Category:** Support
**Created:** [July 6, 2017, 12:46pm UTC](https://meta.discourse.org/t/internal-oneboxing-problem-revisited/65735 "2017-07-06T12:46:46Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@pjv](https://meta.discourse.org/u/pjv)
#### Post date: [July 6, 2017, 12:46pm UTC](https://meta.discourse.org/t/internal-oneboxing-problem-revisited/65735/1 "2017-07-06T12:46:46Z")
I’m seeing a problem similar to that reported in this topic:
> [@Internal URL no longer oneboxing](https://meta.discourse.org/t/internal-url-no-longer-oneboxing/64208/):
>
> At some point in the last 2 days internal URLs stopped oneboxing on my instance. I’m up to date with tests-passed as of 1:15 AM EST 6/9/17. There are the errors I’m seeing in the console when a post with an internal URL is loaded. There do not appear to be any related errors in /logs.
For a forum running on `forum.breadtopia.com`, as of recent discourse updates we are unable to onebox posts from the wordpress site at `breadtopia.com`. Prior to recent updates oneboxing from the wordpress site worked fine.
In this case, there is definitely an internal private network IP active between the two servers and the web server on `breadtopia.com` is not listening on the private IP address. This has not changed recently - the private IP has always been there and nginx on `breadtopia.com` has never listened on that address.
The forum is running version 1.9.0.beta3 and I have used the new whitelist feature (@eviltrout) to whitelist `breadtopia.com` but oneboxing for that domain is still not working and the console shows a 404 error.
Here is a recent example post that should have a onebox:
> **[Kamut® (Khorasan) Sourdough Bread](https://forum.breadtopia.com/t/kamut-khorasan-sourdough-bread/4806)**
>
> This is the comment thread for the Breadtopia blog post originally published here: To leave a comment, click the Reply button below If you do not see the "Reply" button, you will need to log in or register an account. Please click the blue "Log...
Here is an older post where the oneboxing worked correctly for the same domain:
> **[Gluten Free Fermented Buckwheat Bread](https://forum.breadtopia.com/t/gluten-free-fermented-buckwheat-bread/4672)**
>
> This is the comment thread for the Breadtopia blog post originally published here: To leave a comment, click the Reply button below If you do not see the "Reply" button, you will need to log in or register an account. Please click the blue "Log...
---
### Author:  [@pjv](https://meta.discourse.org/u/pjv)
#### Post date: [July 10, 2017, 4:31pm UTC](https://meta.discourse.org/t/internal-oneboxing-problem-revisited/65735/3 "2017-07-10T16:31:33Z")
Anybody here know what changed in Discourse that made oneboxing stop working in situations like I have described above? Anyone have a fix or even a workaround?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [July 10, 2017, 6:43pm UTC](https://meta.discourse.org/t/internal-oneboxing-problem-revisited/65735/4 "2017-07-10T18:43:27Z")
We changed to avoid [SSRF](https://www.acunetix.com/blog/articles/server-side-request-forgery-vulnerability/) attacks. Sorry for changing stuff around but it’s for security reasons which I’m sure in the long term are more important to you.
One thing to check is that the hostname you are whitelisting is an exact match. For example `breadtopia.com` would not match `forum.breadtopia.com`. Having said that, it looks like you were only trying to onebox `breadtopia.com` right?
---
### Author:  [@pjv](https://meta.discourse.org/u/pjv)
#### Post date: [July 10, 2017, 7:14pm UTC](https://meta.discourse.org/t/internal-oneboxing-problem-revisited/65735/5 "2017-07-10T19:14:45Z")
yes, `breadtopia.com` as seen in the two examples I posted above.
Oneboxing `forum.breadtopia.com` works fine.
Here is the admin setting for the whitelist. Let me know if you think that the faulty one-boxing seen in the first post I listed above should be happening.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [July 10, 2017, 7:25pm UTC](https://meta.discourse.org/t/internal-oneboxing-problem-revisited/65735/6 "2017-07-10T19:25:58Z")
I checked your onebox URL and noticed I couldn’t do it on [https://try.discourse.org](https://try.discourse.org) either which is a sign that it’s not related to the internal host check.
The actual problem is that our new onebox engine provides a customer user agent of “Discourse Forum Onebox vXXX” and your wordpress blog blocks it with a `520 Origin Error`. Previously the User-Agent was “Ruby” which your wordpress blog allows.
---
### Author:  [@pjv](https://meta.discourse.org/u/pjv)
#### Post date: [July 10, 2017, 7:33pm UTC](https://meta.discourse.org/t/internal-oneboxing-problem-revisited/65735/7 "2017-07-10T19:33:45Z")
> [@eviltrout](#):
>
> The actual problem is that our new onebox engine provides a customer user agent of “Discourse Forum Onebox vXXX” and your wordpress blog blocks it with a 520 Origin Error. Previously the User-Agent was “Ruby” which your wordpress blog allows.
Excellent - Pretty sure I can fix that on my end. Thank you very much.
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [July 10, 2017, 7:34pm UTC](https://meta.discourse.org/t/internal-oneboxing-problem-revisited/65735/8 "2017-07-10T19:34:02Z")