I’m pretty sure that oneboxing never worked when login_required is enabled. Since the oneboxer makes anonymous HTTP requests, it can only see what’s visible to anonymous users.
I wonder about cross-category oneboxing. If a User A posts in category A with a onebox from category B, but doesn’t have access to category b, will the information be shown?
If User A has access to both categories, but user B, who is in category A, doesn’t have access to category B, a successful onebox might share too much information.
So far as I recall oneboxing worked fine in our login required forum. It was/is a heavy used feature. And it’s not a private category.
We also oneboxed links to private categories. Users without permission didn’t see the box, just the link. If they click the link, they get an “error message”. That’s fine.
If I have the time today I will checkout and test some previous versions of Discourse locally.
Pretty sure I’m sure that is onebox for sure (sorry)
I even sent a PR to fix this on subfolder installs! It uses the local onebox engine, to bypass login. It’s inside the discourse project, not the onebox project.