Third party Unfurl function not reading image secure_url from source site

[dknife]

Affected version

2.1

I assume it's taking the og:image metadata for the image. Example:

Artel

Artel

artelw.com

Source shows an og:image and an og:image:secure_url however only the og_image is used therefore it's causing browser warnings for unsecure images.

This has nothing to do with using a proxy or not either.

 

[Chris D]

This has nothing to do with using a proxy or not either.

That's not strictly true.

The proxy is significant as having image proxy enabled entirely mitigates the issue, as it does here.

While the secure version of the URL is part of the open graph spec, we don’t necessarily aim to support it and it isn’t required. Over time I suspect it will become irrelevant and no longer used. Many sites will just provide the secure version in the standard image field, as we do in XF.

So we won’t be making any changes here.

 

[dknife]

The point was we shouldn't have to enable proxy to mitigate the issue where a simple check for secure url that's part of the spec is a negligible change.

 

[Chris D]

If you’re running over SSL then you should be running the image proxy as it is as otherwise you wouldn’t be able to prevent insecure content warnings.

It’s non sensical to provide an image over two different URLs so really it’s their own metadata and a lack of image proxy that’s the problem.