# Should audio and video tags be allowed?

**URL:** https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709
**Category:** Feature
**Created:** [Février 14, 2014, 4:35 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709 "2014-02-14T04:35:59Z")
**Posts on this page:** 17
**Page:** 1

<div class="post-metadata">

### Author: ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)
#### Post date: [Février 14, 2014, 4:36 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/1 "2014-02-14T04:36:00Z")

</div>

I was just [going over the html sanitizer whitelist](https://github.com/discourse/discourse/pull/1948) and wasn’t sure what to do about `<audio>` and `<video>`.

It seems that they do, in fact, work, but only if you specify `src=` in the audio tag, not in source tags.

This works:

```plaintext
<audio controls autoplay src="https://wiki.teamfortress.com/w/images/6/6c/Spy_DominationDemoMan07.wav?t=20100625234555"></audio>
<video controls autoplay loop src="https://tehurn.com/media/LUIGI_9001_SUPER_SWAGG_XXXX.mp4" >

```

> **Click to expand the audio/video**
>

(TF2 Spy voice reaction and end of Luigi’s Mansion plus Twitch chat jokes on top of Numa Numa, respectively.)

But this doesn’t:

```plaintext
<video controls autoplay>
  <source src="https://wiki.teamfortress.com/w/images/e/e9/Spy_specialcompleted04.wav?t=20100625234706" type="audio/x-wav">
</video>
<video autoplay loop>
  <source src="https://tehurn.com/media/LUIGI_9001_SUPER_SWAGG_XXXX.webm" type="video/webm">
  <source src="https://tehurn.com/media/LUIGI_9001_SUPER_SWAGG_XXXX.mp4" type="video/mp4">
</video>

```

What to do?

Also note that “autoplay” doesn’t actually do anything on a Discourse site.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [Février 14, 2014, 5:39 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/2 "2014-02-14T05:39:39Z")

</div>

No, these should not be allowed.

If you want audio or video, oneboxing should work.

---

<div class="post-metadata">

### Author: ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)
#### Post date: [Février 14, 2014, 5:47 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/3 "2014-02-14T05:47:25Z")

</div>

[https://github.com/riking/discourse/commit/2e864f5ad7a09c71cc4bd7b265e82d7765b34bb2](https://github.com/riking/discourse/commit/2e864f5ad7a09c71cc4bd7b265e82d7765b34bb2)

[Removing more stuff from the sanitizer whitelist by riking · Pull Request #1948 · discourse/discourse · GitHub](https://github.com/discourse/discourse/pull/1948)

---

<div class="post-metadata">

### Author: ![matt\_mcneil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/matt_mcneil/32/81135_2.png) [@matt\_mcneil](https://meta.discourse.org/u/matt_mcneil)
#### Post date: [Décembre 2, 2014, 6:41 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/4 "2014-12-02T18:41:39Z")

</div>

Sorry to revive this old topic; I couldn’t find any answers to my question in newer topics.

Re: using Oneboxing as a solution, my goal is to be able to self-host some private video content (mp4). (One of the goals is to be able to use Discourse’s authorization/group-based access controls).

I think something as simple as this would normally work for me:

```plaintext
<video width="320" height="240" controls>
  <source src=""/uploads/default/172/4158c00ffee987c5.mp4"" type="video/mp4">
</video>

```

I understand how to use the Onebox feature for hosting via YouTube etc, but how can I replicate similar functionality for self-hosted video?

Thanks much!  
Matt

---

<div class="post-metadata">

### Author: ![thangngoc89](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/thangngoc89/32/115436_2.png) [@thangngoc89](https://meta.discourse.org/u/thangngoc89)
#### Post date: [Décembre 2, 2014, 8:02 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/5 "2014-12-02T20:02:04Z")

</div>

You have to use a HTML file with OpenGraph or oEmbed and your domain (which contains your HTML files) is whitelisted

---

<div class="post-metadata">

### Author: ![matt\_mcneil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/matt_mcneil/32/81135_2.png) [@matt\_mcneil](https://meta.discourse.org/u/matt_mcneil)
#### Post date: [Décembre 2, 2014, 10:14 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/6 "2014-12-02T22:14:56Z")

</div>

Thanks for the reply. I’m not sure I understand your proposed solution though. I’d just like to be able to embed a HTML 5 video player (for content that’s already been uploaded to the same Discourse instance/domain) in an ordinary Discourse topic or post. Creating an hosting a separate HTML file to accomplish this seems like a bit too much work. Any other ideas? eg a graceful way to expand the whitelist of allowable HTML tags to include VIDEO?

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [Décembre 3, 2014, 1:37 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/7 "2014-12-03T01:37:10Z")

</div>

Works fine for me?

_Mod edit: removed broken link_

Just paste the URL on a line by itself. Perhaps you are overthinking this? 😉

---

<div class="post-metadata">

### Author: ![matt\_mcneil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/matt_mcneil/32/81135_2.png) [@matt\_mcneil](https://meta.discourse.org/u/matt_mcneil)
#### Post date: [Décembre 3, 2014, 5:30 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/8 "2014-12-03T17:30:40Z")

</div>

Hi Jeff, thanks much for the reply! Unfortunately, your solution doesn’t seem to work for videos self-hosted as uploads on our Discourse site. As you can see below, the robot video mp4 from [techslides.com](http://techslides.com) works fine but the same video when hosted on our site [community.cfmhome.org](http://community.cfmhome.org) renders only as a bare link. (Even though clicking on that bare link will immediately download the file). Is there some setting I have configured incorrectly?

 ![](https://global.discourse-cdn.com/meta/original/3X/2/7/27ec29a37c787902f133019e1456c9654ef474b4.png)  
Any further suggestions?  
Thanks!

---

<div class="post-metadata">

### Author: ![mcwumbly](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mcwumbly/32/103861_2.png) [@mcwumbly](https://meta.discourse.org/u/mcwumbly)
#### Post date: [Décembre 3, 2014, 5:35 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/9 "2014-12-03T17:35:10Z")

</div>

testing that link from meta:

```
https://community.cfmhome.org/uploads/default/172/4158c00ffee987c5.mp4

```

[https://community.cfmhome.org/uploads/default/172/4158c00ffee987c5.mp4](https://community.cfmhome.org/uploads/default/172/4158c00ffee987c5.mp4)

Works here, so maybe its just an issue if its hosted on the same site?

---

<div class="post-metadata">

### Author: ![thangngoc89](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/thangngoc89/32/115436_2.png) [@thangngoc89](https://meta.discourse.org/u/thangngoc89)
#### Post date: [Décembre 3, 2014, 5:37 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/10 "2014-12-03T17:37:07Z")

</div>

@mcwumbly Work in my site too. Did you on lastest version of Discourse

---

<div class="post-metadata">

### Author: ![matt\_mcneil](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/matt_mcneil/32/81135_2.png) [@matt\_mcneil](https://meta.discourse.org/u/matt_mcneil)
#### Post date: [Décembre 3, 2014, 5:55 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/11 "2014-12-03T17:55:40Z")

</div>

Thanks all for the replies!

@mcwumbly Yes, I too was wondering if there might be a same-site restriction? Can you confirm if this is intentional @codinghorror or @sam?

As a side note, this points to one of my goals, which was to have some files which could only be downloaded if the user had access to a particular group. I’ve seen the Site Setting about disallowing anon users from downloading site assets, but I’m guessing that there’s no current way for Discourse to know which category a file was uploaded to and then restrict download access based on group permissions. This question probably deserves a separate topic however…

@thangngoc89, yes, we’re on the latest verison (1.2.0.beta3)

---

<div class="post-metadata">

### Author: ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)
#### Post date: [Décembre 3, 2014, 10:39 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/12 "2014-12-03T22:39:20Z")

</div>

> [@matt\_mcneil](#):
>
> but I’m guessing that there’s no current way for Discourse to know which category a file was uploaded to and then restrict download access based on group permissions

Yup. Uploads are named by SHA hash, so if someone downloads a file and uploads it somewhere else, it has the exact same filename (and file, but that was a given).

---

<div class="post-metadata">

### Author: ![ben\_](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ben_/32/115573_2.png) [@ben\_](https://meta.discourse.org/u/ben_)
#### Post date: [Février 2, 2015, 7:32 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/13 "2015-02-02T07:32:34Z")

</div>

I’m experiencing this issue too; where videos (in my case .mov files) will embed if they are hosted externally, but will not if they are on the same server.

A related issue I have is that videos emailed-in are only recognised as downloadable files / attachments, and a download / attachment link is added to the post body instead of a video embed.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [Décembre 23, 2015, 7:00 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/14 "2015-12-23T19:00:35Z")

</div>

Can you add the internal video file link scenario to your list @techapj? I agree that for .mp4 files uploaded locally the video onebox should work.

---

<div class="post-metadata">

### Author: ![simon](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/simon/32/339122_2.png) [@simon](https://meta.discourse.org/u/simon)
#### Post date: [Décembre 24, 2015, 6:45 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/15 "2015-12-24T06:45:57Z")

</div>

Could this be made to work with audio files as well?

---

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [Décembre 24, 2015, 8:24 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/16 "2015-12-24T20:24:24Z")

</div>

> [@codinghorror](#):
>
> for .mp4 files uploaded locally the video onebox should work.

> [@simon](#):
>
> Could this be made to work with audio files as well?

Okay, done! 🎄

[https://github.com/discourse/discourse/commit/3a28bafc0f233710cff868319eb7f70672f53bad](https://github.com/discourse/discourse/commit/3a28bafc0f233710cff868319eb7f70672f53bad)

---

<div class="post-metadata">

### Author: ![techAPJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/techapj/32/342990_2.png) [@techAPJ](https://meta.discourse.org/u/techAPJ)
#### Post date: [Mars 23, 2016, 1:23 UTC](https://meta.discourse.org/t/should-audio-and-video-tags-be-allowed/12709/17 "2016-03-23T13:23:24Z")

</div>