Onebox, favicons et « Hotlink Protection » de Cloudflare

The following WordPress site is behind Cloudflare, currently with " Scrape Shield", “Hotlink Protection” off:

https://www.thenews.coop/139235/sector/worker-coops/worker-co-op-weekend-2019-restorative-sociable-inspiring-get-together/

When “Hotlink Protection” is on the article image is downloaded by Discourse to display in the onebox but the favicon is not (in Firefox this is clear as there is an empty box):

This is the HTML source:

<img src="https://www.thenews.coop/wp-content/uploads/favicon-1.ico" 
     class="site-icon" width="64" height="64">

With “Hotlink Protection” on the favicon is not displayed due to the Cloudflare serving a “Error 1011, Access denied”.

I was also wondering, has the downloading and serving locally, of favicons been considered for cases where Cloudflare’s “Hotlink Protection” is on?

How would you do that? And if someone had gone to lengths to see that you can’t download those images my response is either “serves them right” or “I will respect their wishes.”

De la même manière que pour les autres images ?

Voir cette onebox :

L’URL de l’image du feu de joie est :

![](upload://yL3c0erBE8QgCGLh5SKlzQJ1nZj.jpeg)

Elle a été téléchargée par Discourse depuis le site d’origine à cette URL :

https://www.thenews.coop/wp-content/uploads/D6eFNECXkAM9BmG-1280x600.jpg

Tout ce que je demande, c’est : est-ce que cela aurait du sens de traiter les favicons de la même manière que les autres images — télécharger des copies et les servir localement ?

Testez vous-même le comportement actuel : activez la « Protection contre le hotlink » sur un site derrière Cloudflare et vous constaterez que Discourse télécharge toujours les images principales pour les oneboxes…

They will as long as they are in a format your Discourse accepts. The example in OP is using .ico, which is an old format not allowed in Discourse by default. You can add it to the list in your site.

I added .ico to authorized extensions and rebuilt the HTML of a post and while the favicon wasn’t downloaded and served locally straight away it was when I checked it a couple of days later.