Our site has been using this module to integrate Vimeo oEmbed videos with domain-level privacy for years now, but recently (between 12/23/18 and 12/28/18) the oEmbed API has not been returning the full video metadata that we've been expecting (i.e. video title, video duration, etc.). You may notice that an imported Vimeo video now has "Embedded video media on Vimeo" for it's title instead of the actual video title.
The Vimeo oEmbed documentation states:
NOTE: In the case of a video with domain-level privacy, the oEmbed request returns a simplified response containing the embed code only and no private metadata. To get the complete response, send the Referer header along with the request, and set its value to the video's whitelisted domain.
I can confirm that adding the correct Referer header to the drupal_http_request() in media_oembed_default_callback() corrects this issue:
$options = array('headers' => array('Referer' => $_SERVER['HTTP_REFERER']));
$response = drupal_http_request($fetch_url, $options);However, it would be nice to implement an optional config (similar to Stage File Proxy's stage_file_proxy_headers in stage_file_proxy_fetch_file()) to allow users to opt in with custom headers.
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | media_oembed-add_config_for_custom-3023798-4-D7.patch | 3.61 KB | hargobind |
| #3 | media_oembed-add-config-for-custom-http-headers-3023798.patch | 3.01 KB | firewaller |
Comments
Comment #2
firewaller commentedComment #3
firewaller commentedPatch attached. The functionality is largely adapted from Stage File Proxy module.
Comment #4
hargobindExcellent find @firewaller. Glad to know that the workaround is simply a matter of passing the REFERER header instead of an elaborate API call.
One possible caveat here...
There is an additional call to
drupal_http_request()to get the thumbnail. In my testing, the REFERER was necessary for making the initial oEmbed request. But the thumbnail was retrieved even without the added header.So although Vimeo currently doesn't restrict access to a thumbnail for a private video, they may do so in the future, or other oEmbed providers might do it.
Attached is a patch which adds the headers to that additional
drupal_http_request()call. Even if this isn't strictly necessary, I can't imagine any reason it would negatively impact requests.