# Steam links inconsistently oneboxed & editor preview not displaying correctly

**URL:** https://meta.discourse.org/t/steam-links-inconsistently-oneboxed-editor-preview-not-displaying-correctly/64984
**Category:** Bug
**Created:** [June 23, 2017, 2:35am UTC](https://meta.discourse.org/t/steam-links-inconsistently-oneboxed-editor-preview-not-displaying-correctly/64984 "2017-06-23T02:35:22Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Yuun](https://avatars.discourse-cdn.com/v4/letter/y/977dab/32.png) [@Yuun](https://meta.discourse.org/u/Yuun)
#### Post date: [June 23, 2017, 2:35am UTC](https://meta.discourse.org/t/steam-links-inconsistently-oneboxed-editor-preview-not-displaying-correctly/64984/1 "2017-06-23T02:35:23Z")

</div>

**Issue:**

Taking the following links as an example:

```plaintext
http://store.steampowered.com/app/107410/Arma_3/

http://store.steampowered.com/app/286160/Tabletop_Simulator/

```

The top link will show up as a normal oneboxed link, while the bottom will show up with the nice custom Steam look. This happens across various links to steam store pages, so if you were to paste a large list you’d have some getting oneboxed one way and some the other. I don’t know of any reason why some links work and some don’t, just from a quick observation.

Additionally, the top link will onebox correctly in the preview pane of the editor, while the bottom link will show up as a large gray square (I think this may have always been a bit wonky, though? - just wanted to mention it).

> **[Arma 3 on Steam](https://store.steampowered.com/app/107410/Arma_3/)**
>
> Experience true combat gameplay in a massive military sandbox. Deploy with a wide variety of single- and multiplayer content, a massive arsenal of modern weapons and vehicles, and limitless opportunities for content creation. Authentic, diverse, open...

> **[Tabletop Simulator on Steam](https://store.steampowered.com/app/286160/Tabletop_Simulator/)**
>
> Tabletop Simulator is the only simulator where you can let your aggression out by flipping the table! There are no rules to follow: just you, a physics sandbox, and your friends. Make your own online board games or play the thousands of community...

As a note, I don’t think the steam store apps used to include the name of the game at the end, but it doesn’t seem to make a difference either way that they’re there.

---

<div class="post-metadata">

### Author: ![mpalmer](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/mpalmer/32/45740_2.png) [@mpalmer](https://meta.discourse.org/u/mpalmer)
#### Post date: [June 23, 2017, 4:39am UTC](https://meta.discourse.org/t/steam-links-inconsistently-oneboxed-editor-preview-not-displaying-correctly/64984/2 "2017-06-23T04:39:45Z")

</div>

Looking at the rendered HTML for your post, you can see that the first link is being rendered as a regular ol’ onebox, while the latter is being included wholesale in an iframe. The class on the `<aside>` is `whitelistedgeneric`, which is what [the onebox gem](https://github.com/discourse/onebox) uses when it can’t figure out what else to do with a page that has oEmbed/OpenGraph tags.

Now, where this gets _really_ interesting is that, if I call onebox directly, everything works:

```
>> Onebox.preview('http://store.steampowered.com/app/107410/Arma_3/').to_s
=> " <iframe src=\"https://store.steampowered.com/widget/107410\" frameborder=\"0\" width=\"100%\" height=\"190\" seamless=\"seamless\" sandbox=\"allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox\">\n </iframe>\n"
>> Onebox.preview('http://store.steampowered.com/app/286160/Tabletop_Simulator/').to_s
=> " <iframe src=\"https://store.steampowered.com/widget/286160\" frameborder=\"0\" width=\"100%\" height=\"190\" seamless=\"seamless\" sandbox=\"allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox\">\n </iframe>\n"

```

That’s with both the latest git code, and what I _think_ is the release running in Discourse at the moment (1.8.8; the git repo doesn’t consistently have release tags, so I’m kinda flying blind a bit).

So… this looks like it is a Discourse-specific problem, somehow. I can reproduce the problem on try, which is heartening. However, running the code _on meta_, behind the scenes, works as expected:

```
$ ./mothership console meta
[1] pry(main)> Onebox.preview('http://store.steampowered.com/app/107410/Arma_3/').to_s
=> " <iframe src=\"https://store.steampowered.com/widget/107410\" frameborder=\"0\" width=\"100%\" height=\"190\" seamless=\"seamless\" sandbox=\"allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox\">\n" +
" </iframe>\n"
[2] pry(main)> Onebox.preview('http://store.steampowered.com/app/286160/Tabletop_Simulator/').to_s
=> " <iframe src=\"https://store.steampowered.com/widget/286160\" frameborder=\"0\" width=\"100%\" height=\"190\" seamless=\"seamless\" sandbox=\"allow-same-origin allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox\">\n" +
" </iframe>\n"

```

It’s at this point I’m going to stop, because my appetite for mysteries has been satiated. I call upon someone else on the [@team](https://meta.discourse.org/groups/team) to take up utensils!

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 23, 2017, 1:07pm UTC](https://meta.discourse.org/t/steam-links-inconsistently-oneboxed-editor-preview-not-displaying-correctly/64984/3 "2017-06-23T13:07:41Z")

</div>

@eviltrout maybe have a look at this, its a bit odd. 🤕

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [June 26, 2017, 7:41pm UTC](https://meta.discourse.org/t/steam-links-inconsistently-oneboxed-editor-preview-not-displaying-correctly/64984/5 "2017-06-26T19:41:06Z")

</div>

It’s another issue with our SSRF protection that follows redirects. In this case, we try to follow redirects on Steam URLs, and some pages are age restricted. Tabletop Simulator is an all ages game but Arma 3 requires you to be 18 to view.

The solution was to add a list of sites to “avoid redirects” from with steam in it for now. It works again (but previous versions will need to be re-baked.)

[https://github.com/discourse/discourse/commit/db485ae0da9391b7e4cac573d992f4d0ea2ab7e4](https://github.com/discourse/discourse/commit/db485ae0da9391b7e4cac573d992f4d0ea2ab7e4)

---

<div class="post-metadata">

### Author: ![Yuun](https://avatars.discourse-cdn.com/v4/letter/y/977dab/32.png) [@Yuun](https://meta.discourse.org/u/Yuun)
#### Post date: [June 26, 2017, 9:32pm UTC](https://meta.discourse.org/t/steam-links-inconsistently-oneboxed-editor-preview-not-displaying-correctly/64984/6 "2017-06-26T21:32:19Z")

</div>

Confirmed working on my site now.

Thanks!

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [June 26, 2017, 9:35pm UTC](https://meta.discourse.org/t/steam-links-inconsistently-oneboxed-editor-preview-not-displaying-correctly/64984/7 "2017-06-26T21:35:43Z")

</div>


