Steps to reproduce:
We were trying to find a way to have better Embeds support for AO3 and load out own content. AO3 allows some website inside iframes, but we discovered the website didn't check for youtube.com/redirect?q=...
So we decided to test this and provide one of our links as the "q" parameter.
The exact code used is:
<iframe width="100%" height="1000vh" src="https://www.youtube.com/redirect?event=null&redir_token=QUFFLUhqbEU4bnBhaF9sc2VIQWtmRkx0NE55YnQ0U2FsQXxBQ3Jtc0tsRko0MFJRazhFUGtjdXJXQnpmWF9iMjhWR2RKekxwVE5TdjR3bzdvN0d3cWJoR1hCcUJwR2lyZjlFQzdEdG5QMnZqdUExTXRRakY1c0RXdDBDNlVxQnlTcUdKd2MwWXAwcVZBVzRtNXVhU0R1U2t6Yw&q=%68%74%74%70%73%3A%2F%2Fwo3.tbvns.xyz/write&v=yUB6OYeCKek"></iframe>
Without the extension:
The request fails with:
The loading of “https://www.youtube.com/redirect?event=null&redir_token=QUFFLUhqbEU4bnBhaF9sc2VIQWtmRkx0NE55YnQ0U2FsQXxBQ3Jtc0tsRko0MFJRazhFUGtjdXJXQnpmWF9iMjhWR2RKekxwVE5TdjR3bzdvN0d3cWJoR1hCcUJwR2lyZjlFQzdEdG5QMnZqdUExTXRRakY1c0RXdDBDNlVxQnlTcUdKd2MwWXAwcVZBVzRtNXVhU0R1U2t6Yw&q=%68%74%74%70%73%3A%2F%2Fwo3.tbvns.xyz/write&v=yUB6OYeCKek” in a frame is denied by “X-Frame-Options“ directive set to “sameorigin“.
With the extension, the request succeed and therefore the Iframe loads.
Showcase: https://archiveofourown.org/works/69026231
Steps to reproduce:
We were trying to find a way to have better Embeds support for AO3 and load out own content. AO3 allows some website inside iframes, but we discovered the website didn't check for youtube.com/redirect?q=...
So we decided to test this and provide one of our links as the "q" parameter.
The exact code used is:
Without the extension:
The request fails with:
The loading of “https://www.youtube.com/redirect?event=null&redir_token=QUFFLUhqbEU4bnBhaF9sc2VIQWtmRkx0NE55YnQ0U2FsQXxBQ3Jtc0tsRko0MFJRazhFUGtjdXJXQnpmWF9iMjhWR2RKekxwVE5TdjR3bzdvN0d3cWJoR1hCcUJwR2lyZjlFQzdEdG5QMnZqdUExTXRRakY1c0RXdDBDNlVxQnlTcUdKd2MwWXAwcVZBVzRtNXVhU0R1U2t6Yw&q=%68%74%74%70%73%3A%2F%2Fwo3.tbvns.xyz/write&v=yUB6OYeCKek” in a frame is denied by “X-Frame-Options“ directive set to “sameorigin“.With the extension, the request succeed and therefore the Iframe loads.
Showcase: https://archiveofourown.org/works/69026231