Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion embed_video/templates/embed_video/embed_code.html
Original file line number Diff line number Diff line change
@@ -1 +1 @@
<iframe width="{{ width }}" height="{{ height }}" src="{{ backend.url }}" loading="lazy" frameborder="0" allowfullscreen></iframe>
<iframe width="{{ width }}" height="{{ height }}" src="{{ backend.url }}" loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is getting added for all backends rather than just YouTube, which I don't think is the intention or desirable.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For instance could add a variable to the default embed_code.html and the YouTube backend either uses a template that inherits from that one, or maybe just the code for the YT backend fills in that variable.

Copy link
Contributor Author

@Letme Letme Feb 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you explain me why this would not be good for Vimeo? What would break by explicitly defining it?

Copy link
Contributor Author

@Letme Letme Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can I ping on this as a decision? Because if you want me to put a backend around then fine, but I need the changes from official release, as now I have to manually fix the template post installation.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Letme Hello! Sorry to be a holdup on this, and thanks to you and @aleksihakli for the feedback and patience.

My worry was that it would be leaking more information to the host of the video than before, but now I'm not quite sure. According to W3C no-referrer-when-downgrade is the default, while MDN says it's no-referrer-when-downgrade. Looks like Chrome changed defaults from the former to the latter many years ago and so I'm guessing at least some other browsers have as well.

So it looks like this isn't even much of a change in most cases, which makes me wonder why it works/is necessary, but I don't see a reason to hold it up anymore at least.

Thanks for this change @Letme!

18 changes: 9 additions & 9 deletions embed_video/tests/templatetags/tests_embed_video_tags.py
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ def test_embed(self):
template,
'<iframe width="960" height="720" '
'src="https://www.youtube.com/embed/jsrRJyHBvzw?wmode=opaque" '
'loading="lazy" frameborder="0" allowfullscreen></iframe>',
'loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>',
)

def test_embed_invalid_url(self):
Expand Down Expand Up @@ -97,7 +97,7 @@ def test_direct_embed_tag(self):
template,
'<iframe width="960" height="720" '
'src="https://www.youtube.com/embed/jsrRJyHBvzw?wmode=opaque" '
'loading="lazy" frameborder="0" allowfullscreen></iframe>',
'loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>',
)

def test_direct_embed_tag_with_default_size(self):
Expand All @@ -109,7 +109,7 @@ def test_direct_embed_tag_with_default_size(self):
template,
'<iframe width="480" height="360" '
'src="https://www.youtube.com/embed/jsrRJyHBvzw?wmode=opaque" '
'loading="lazy" frameborder="0" allowfullscreen></iframe>',
'loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>',
)

def test_direct_embed_invalid_url(self):
Expand All @@ -130,7 +130,7 @@ def test_user_size(self):
template,
'<iframe width="800" height="800" '
'src="https://www.youtube.com/embed/jsrRJyHBvzw?wmode=opaque" '
'loading="lazy" frameborder="0" allowfullscreen></iframe>',
'loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>',
)

def test_wrong_size(self):
Expand Down Expand Up @@ -233,7 +233,7 @@ def test_relative_size(self):
template,
'<iframe width="80%" height="30%" '
'src="https://player.vimeo.com/video/72304002" '
'loading="lazy" frameborder="0" allowfullscreen></iframe>',
'loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>',
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this needed for Vimeo too?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I did not find any information for it. Should this be a blocker?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just mean that I think this test should probably fail because it's checking for the referrer policy for Vimeo and not for YouTube.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

)

def test_allow_spaces_in_size(self):
Expand All @@ -245,7 +245,7 @@ def test_allow_spaces_in_size(self):
template,
'<iframe width="80%" height="300" '
'src="https://player.vimeo.com/video/72304002" '
'loading="lazy" frameborder="0" allowfullscreen></iframe>',
'loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>',
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this needed for Vimeo too?

)

def test_embed_with_query(self):
Expand Down Expand Up @@ -285,7 +285,7 @@ def test_direct_embed_with_query(self):
output_without_url,
'<iframe width="480" height="360" '
'src="URL" '
'loading="lazy" frameborder="0" allowfullscreen></iframe>',
'loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>',
)

def test_set_options(self):
Expand All @@ -297,7 +297,7 @@ def test_set_options(self):
template,
'<iframe width="300" height="200" '
'src="https://www.youtube.com/embed/jsrRJyHBvzw?rel=1" '
'loading="lazy" frameborder="0" allowfullscreen></iframe>',
'loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>',
)

def test_size_as_variable(self):
Expand All @@ -311,7 +311,7 @@ def test_size_as_variable(self):
template,
'<iframe width="500" height="200" '
'src="https://www.youtube.com/embed/jsrRJyHBvzw?wmode=opaque" '
'loading="lazy" frameborder="0" allowfullscreen></iframe>',
'loading="lazy" frameborder="0" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>',
)


Expand Down
Loading