Reputation: 59
I am trying to embed my client videos in our website. The videos are set to domain level privacy. I am using the generated code from Vimeo
<div style="padding:28% 0 0 0;position:relative;">
<iframe src="https://player.vimeo.com/video/{{video_id}}" style="position:absolute;top:0;left:0;width:100%;height:100%;" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen ></iframe>
</div>
where ```{{video_id}}`` is the id of the video. I have followed all the documentation and made sure that the listed domain is spelled correctly.
I am getting:
Sorry
Because of its privacy settings, this video cannot be played here.
Why? What am I doing wrong?
Upvotes: 2
Views: 16030
Reputation: 86
Looks like you got it. Apparently there was a change w/ Django 3.1 that causes this.
https://docs.djangoproject.com/en/4.0/releases/3.1/#security
You can fix it with a Django setting. This is one option, but any of the valid referrer policies that share the origin with Vimeo will work.
SECURE_REFERRER_POLICY = "strict-origin-when-cross-origin"
Upvotes: 2
Reputation: 3073
Here is the issue:
That is request of iframe in django page, (particularly, ones are under proxy server), does not have http_referer or its value does not match the domain which has been set for the video on vimeo.
I have figured out. Just add this attribute to iframe tag and it works:
<iframe ...referrerpolicy="strict-origin"></iframe>
Upvotes: 4