Twitter embed video in Discord about betterfox

[yokoffing]

Thanks for reporting the issue! I'm always fascinated by inconsistencies like this one.

when disabling Tracking Protection, the embed Twitter video plays just fine in Discord

I cannot reproduce your workaround. Disabling Tracking Protection outright still fails to play the embed. In fact, the same behavior occurs with:

• Brave with Allow Twitter embedded tweets enabled and Shields disabled
• Microsoft Edge w/ Basic Tracking Prevention and allowing 3rd party cookies
• Chrome
• Discord app for Windows 11 on another computer, using a different account
• On the Discord app for iOS: a preview of the tweet shows but not the media player portion, unlike it does for Discord on desktops

The tweet preview in Discord is coming from twitter.com, abs.twimg.com, and api.twitter.com, whereas embedded tweet widgets on webpages comes from platform.twitter.com. The request type is different, too.

I had to add twitter.com to our two urlclassifier pref strings from SecureFox so that the twitter.com and abs.twimg.com requests would not be blocked by Firefox's Tracking Protection. But doing that, and even disabling TP outright, didn't change anything.

The third request the tweet preview calls for, api.twitter.com, is flagged by CORS in all the aforementioned web browsers I tested. It's only allowed to load on twitter.com; no other websites. And if that's what's needed for the tweet preview to play, then this would explain why it didn't work on any other browsers I tested:

You can read more about CORS below:

• https://portswigger.net/web-security/cors
• https://medium.com/@electra_chong/what-is-cors-what-is-it-used-for-308cafa4df1a
• https://www.keycdn.com/support/cors#a-real-world-example-of-how-cors-works

If more users report that they can play with Tracking Protection disabled, we can look dig further into the breakage.

[Zelmanyr]

Hi,
I just tried with a fresh firefox profile, and it didn't play the video. However, after disabling Tracking Protection, it just played fine. Same with Arkenfox user.js. I would like to know, can we disable tracking protection completely and only rely on ublock origin ? What do we lose if we do that ? I would prefer relying on ublock origin since it is way more customizable than tracking protection for me.

EDIT : Just tried Librewolf, same thing, same workaround.

[yokoffing]

I still am not able to reproduce the solution. I tried again on a fresh Firefox Nightly profile on my work network (which doesn't use NextDNS like my home network). Didn't use uBO or TP; still didn't fetch the video.

One option you can try without disabling Tracking Protection: Add twitter.com to your two urlclassifier prefs. They should look like this after adding:

user_pref("urlclassifier.trackingSkipURLs", "*.reddit.com, *.twitter.com, *.twimg.com, twitter.com");
user_pref("urlclassifier.features.socialtracking.skipURLs", "*.instagram.com, *.twitter.com, *.twimg.com, twitter.com");

If that still doesn't work: You can disable Tracking Protection for https://discord.com in the Firefox settings, if Twitter video previews are that frequent for your usecase.

can we disable tracking protection completely and only rely on ublock origin ?

I don't advise that. You can use both, and Tracking Protection goes beyond blocking certain requests. You can always disable Tracking Protection for certain sites, but I never need to.

[yokoffing]

Archiving for now.