# Whitelist to allow onebox only with https domains?

**URL:** <https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820>\
**Category:** Product Support\
**Created:** [29 באוקטובר,‏ 2018,‏ 7:01pm UTC](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820 "2018-10-29T19:01:12Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![keith1](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/keith1/32/178982_2.png) [@keith1](https://meta.discourse.org/u/keith1)\
**Post date:** [29 באוקטובר,‏ 2018,‏ 8:19pm UTC](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820/4 "2018-10-29T20:19:07Z")

</div>

> [@Stephen](#):
>
> Those are almost the best case scenario too. If a site owner realises you’re using their disk space and bandwidth, it’s not unheard of for them to replace or redirecting all of the requests to “unsavory” pictures.

I think you’re forgetting about the entire section of the internet dedicated to hosting and delivering content. Giphy, Imgur, youtube, vimeo, etc. Additionally, almost all of the content our users are posting are from their own portfolio websites, either self hosted, or once again on content delivery platforms (art station, medium, etc)

> [@Stephen](#):
>
> This is why Discourse will automatically download any images linked within posts. Image links aren’t oneboxed at all, they will be served from the remote server only until Discourse gets around to downloading a copy and updating the URL to a local link.

Is that true even when this flag is unchecked?  
 ![image](https://global.discourse-cdn.com/meta/original/3X/c/5/c51c1edea0382265c9712e3f3c7fe16cacbe4335.png)

> [@Falco](#):
>
> Using Digital Ocean Spaces will give you 250GB of image hosting per $5 a month. Enabling that + the Discouse `download remote images to local` setting can give you a very fast experience, while allowing users to add images from anywhere that are automatically fixed.

Yes, I’m aware of the various ways that I can self host. That $5 when combined with CDN fees, stored for perpetuity combined with exponential growth of users and content doesn’t lead down a path that I’m interested in pursuing without exploring other options.

I appreciate both of your responses, but neither of you actually addressed the question I’ve asked:

_I know I can whitelist only explicit domains, but I’m curious if it’s possible to set to allow any https domain._

---

_[View the full topic](https://meta.discourse.org/t/whitelist-to-allow-onebox-only-with-https-domains/100820)._