2

I have a drupal 9 site where I use the media library. I've created a media type with source "External video", allowing youtube videos. As far as I can see this uses oEmbed.

I've added a media reference field for this type in a contenttype and created content. However, when I try to view the page the video won't show and I have a mixed content warning in the console of the browser.

Mixed Content: The page at 'https://xxx' was loaded over HTTPS, but requested an insecure frame
 'http://xxx/media/oembed/?url=https%3A//youtu.be/someIDHERE&max_width=890&max_height=560&hash=0nPSIkGE5CqEuiNAmZ1wdR1rXpwkg5r3GkoTyeZaR-g'. 
This request has been blocked; the content must be served over HTTPS.

I've set all correct settings for reverse proxy in settings.php, and the base url in the settings reflects this by showing https, but somehow this particular part of Drupal insists on using http, rather than https.

How can I make sure it requests this video frame using https?

Improve this question
3
  • What is your setting for I-Frame domain in /admin/config/media/media-settings?
    – Hudri
    Commented Feb 18, 2021 at 12:00
  • Haven't added anything there, it's still empty.
    – KeairaSedai
    Commented Feb 18, 2021 at 12:07
  • I'm having the same issue in a Drupal 10 site. But it varies depending on the server. In my local copy of the site, Drupal loads the iframe over https, so there is no problem. But on the remote server, Drupal loads the iframe over http, preventing the content from displaying and causing "mixed content" errors in the console.
    – arnoldbird
    Commented Apr 18 at 17:42

1 Answer 1

Reset to default
2

As @Hudri suggested, supply an iFrame domain at /admin/config/media/media-settings

See the help text below the field for further assistance.

Filling in this field with the site's URL (using the https protocol) resolved the issue for me.

Improve this answer
1
  • This worked for me too. But It is giving me some security warnings. Warning message Close It is potentially insecure to display oEmbed content in a frame that is served from the same domain as your main Drupal site, as this may allow execution of third-party code. Refer to oEmbed Security Considerations.
    – Rifas Ali
    Commented Aug 21 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.