# Onebox whitelist missing #2

**URL:** https://meta.discourse.org/t/onebox-whitelist-missing-2/52092
**Category:** Support
**Created:** [October 27, 2016, 11:25am UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092 "2016-10-27T11:25:58Z")
**Posts on this page:** 16
**Page:** 1

<div class="post-metadata">

### Author: ![rpasichnyk](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@rpasichnyk](https://meta.discourse.org/u/rpasichnyk)
#### Post date: [October 27, 2016, 11:25am UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/1 "2016-10-27T11:25:58Z")

</div>

Sorry I have to create a thread again, because my previous thread was closed

[https://meta.discourse.org/t/onebox-whitelist-missing/52000/3](https://meta.discourse.org/t/onebox-whitelist-missing/52000/3)

Unfortunately if domain is not whitelisted in `whitelisted_generic_onebox.rb` it won’t be oneboxed. I am doing a test with my domain, and I don’t even receive `GET` request. I also tried to test with `rake server` as suggested here [GitHub - discourse/onebox: (DEPRECATED) A gem for turning URLs into website previews · GitHub](https://github.com/discourse/onebox) and it is the same behaviour.

The domain has to be whitelisted it seems. And it is stated in onebox documentation

> 1. The domain must be whitelisted

I and I could not find you are doing any whitelisting in the discourse codebase.

---

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [October 27, 2016, 11:53am UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/2 "2016-10-27T11:53:24Z")

</div>

What exactly are you trying to onebox? Does it work here on Meta?

---

<div class="post-metadata">

### Author: ![rpasichnyk](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@rpasichnyk](https://meta.discourse.org/u/rpasichnyk)
#### Post date: [October 27, 2016, 12:02pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/3 "2016-10-27T12:02:15Z")

</div>

I am trying to onebox jpg image. I have my local installation of discourse on VirtualBox where I am trying to make this work. By the way there is a bug in onebox implementation. Here’s the pull request: [search for 'url', not 'image', if oembed is of 'photo' type by orangefour · Pull Request #331 · discourse/onebox · GitHub](https://github.com/discourse/onebox/pull/331)

---

<div class="post-metadata">

### Author: ![rpasichnyk](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@rpasichnyk](https://meta.discourse.org/u/rpasichnyk)
#### Post date: [October 27, 2016, 12:06pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/4 "2016-10-27T12:06:27Z")

</div>

I managed to onebox with `rake server` when I add my domain to `whitelisted_generic_onebox.rb`. Otherwise it doesn’t work. As I said earlier, onebox doesn’t even try to `GET` if the domain is not whitelisted.

---

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [October 27, 2016, 12:54pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/5 "2016-10-27T12:54:56Z")

</div>

I’m not a Ruby developer so the PR is beyond me. Regardless, does whatever you are trying to embed work here on Meta or on [http://try.discourse.org](http://try.discourse.org)?

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [October 27, 2016, 1:03pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/6 "2016-10-27T13:03:03Z")

</div>

Could you share the link you’re trying to onebox. I’M actually working on fixing an improving our oEmbed and OpenGraph support.

---

<div class="post-metadata">

### Author: ![rpasichnyk](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@rpasichnyk](https://meta.discourse.org/u/rpasichnyk)
#### Post date: [October 27, 2016, 1:03pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/7 "2016-10-27T13:03:57Z")

</div>

Unfortunately I can not share the link, but the effect can be observed if you remove 23hq from onebox whitelist and test this url: [23: Kai Krause - mprove](http://www.23hq.com/mprove/photo/13297717)  
It has oembed type of ‘photo’

---

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [October 27, 2016, 1:04pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/8 "2016-10-27T13:04:14Z")

</div>

> **[23: Kai Krause - mprove](https://www.23hq.com/mprove/photo/13297717)**
>
> Kai Krause
> 
> cf. https://commons.wikimedia.org/wiki/File:KaiKrause.jpg

Edit: Seems to work just fine here…

---

<div class="post-metadata">

### Author: ![rpasichnyk](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@rpasichnyk](https://meta.discourse.org/u/rpasichnyk)
#### Post date: [October 27, 2016, 1:05pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/9 "2016-10-27T13:05:54Z")

</div>

It works fine because it is present in the whitelist. Here [https://github.com/discourse/onebox/blob/master/lib/onebox/engine/whitelisted\_generic\_onebox.rb#L19](https://github.com/discourse/onebox/blob/master/lib/onebox/engine/whitelisted_generic_onebox.rb#L19)

---

<div class="post-metadata">

### Author: ![jomaxro](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/jomaxro/32/126216_2.png) [@jomaxro](https://meta.discourse.org/u/jomaxro)
#### Post date: [October 27, 2016, 1:06pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/10 "2016-10-27T13:06:59Z")

</div>

OK then, can you share an example that isn’t in the whitelist?

---

<div class="post-metadata">

### Author: ![rpasichnyk](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@rpasichnyk](https://meta.discourse.org/u/rpasichnyk)
#### Post date: [October 27, 2016, 1:11pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/11 "2016-10-27T13:11:13Z")

</div>

This should not work

[http://www.mobypicture.com/user/Henk\_Voermans/view/15880044](http://www.mobypicture.com/user/Henk_Voermans/view/15880044)

Though it does. Now I’m puzzled

---

<div class="post-metadata">

### Author: ![rpasichnyk](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@rpasichnyk](https://meta.discourse.org/u/rpasichnyk)
#### Post date: [October 27, 2016, 1:14pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/12 "2016-10-27T13:14:11Z")

</div>

Probably because this forum is not running the latest git version of discourse. On my VirtualBox installation this link does not work [http://www.mobypicture.com/user/Henk\_Voermans/view/15880044](http://www.mobypicture.com/user/Henk_Voermans/view/15880044)

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [October 27, 2016, 1:14pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/13 "2016-10-27T13:14:15Z")

</div>

Yeah that’s because of this file

[https://github.com/discourse/discourse/blob/master/lib/onebox/engine/whitelisted\_generic\_onebox.rb](https://github.com/discourse/discourse/blob/master/lib/onebox/engine/whitelisted_generic_onebox.rb)

---

<div class="post-metadata">

### Author: ![rpasichnyk](https://avatars.discourse-cdn.com/v4/letter/r/df788c/32.png) [@rpasichnyk](https://meta.discourse.org/u/rpasichnyk)
#### Post date: [October 27, 2016, 1:18pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/14 "2016-10-27T13:18:18Z")

</div>

Thank you! I will continue my investigation from there

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 27, 2016, 11:26pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/15 "2016-10-27T23:26:03Z")

</div>

There is no more whitelist as of a few days ago. ALL URLS ARE WHITELISTED.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 27, 2016, 11:26pm UTC](https://meta.discourse.org/t/onebox-whitelist-missing-2/52092/16 "2016-10-27T23:26:19Z")

</div>


