Bug #77409
closed
Invalid origin for JS API enabled Youtube videos
100%
Description
The YouTubeRenderer has the option enablejsapi that allows script access on the embedded Youtube video.
That is a feature provided by Youtube, which is documented here: https://developers.google.com/youtube/player_parameters#origin
As recommended the YouTubeRenderer sets the origin parameter, but it only contains the host name while in Youtube examples origin also contains the request scheme.
For me accessing the video only works when the origin is provided with request scheme.
<iframe id="ytplayer" type="text/html" width="640" height="390" src="https://www.youtube.com/embed/M7lc1UVf-VE?autoplay=1&origin=example.com" frameborder="0"></iframe>
=> script access doesn't work
<iframe id="ytplayer" type="text/html" width="640" height="390" src="https://www.youtube.com/embed/M7lc1UVf-VE?autoplay=1&origin=http://example.com" frameborder="0"></iframe>
=> script access works
Updated by Sebastian Michaelsen over 7 years ago
The Youtube guy also says it in the documentation video: "Use the full url of your webpage as origin"
https://youtu.be/M7lc1UVf-VE?t=17m2s
Updated by Gerrit Code Review over 7 years ago
- Status changed from New to Under Review
Patch set 2 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/49416
Updated by Gerrit Code Review over 7 years ago
Patch set 3 for branch master of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/49416
Updated by Gerrit Code Review over 7 years ago
Patch set 1 for branch TYPO3_7-6 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/49572
Updated by Anonymous over 7 years ago
- Status changed from Under Review to Resolved
- % Done changed from 0 to 100
Applied in changeset 84ab41333988a4217fd496a3d3063db537483ada.
Updated by Ruud Silvrants over 7 years ago
When the request uri contains some get params the origin breaks with the youtube api.
The youtube api says: "you should always specify your domain as the origin parameter value."
For example my domain created is : //www.youtube.com/embed/YE7VzlLtp-4?autohide=1&controls=2&enablejsapi=1&origin=http://example.com/index.php?id=275&type=80001&showinfo=0.
Updated by