YT Playlist embeds do not work when using the youtube-nocookie option

[teezeh]

Could this be related to cookpete/react-player#2030 ?

[ImMortaL0P]

Not quite the same root cause as cookpete/react-player#2030, but the same category of bug (the list param gets lost when building the embed URL) — and it's happening in Publii itself, not YouTube/nocookie specifically. Traced it in the source: app/src/components/block-editor/components/default-blocks/publii-embed/embed.js:

youtubeIframe (code) {
  let url = code;
  let queryParams = new URLSearchParams(url.split('?')[1]);

  if (queryParams.has('v')) {
    url = 'https://www.youtube.com/embed/' + queryParams.get('v') + '?feature=oembed';
  }
  return '<iframe src="' + url + '" ...></iframe>';
},

This only ever reads the v (video id) query param — it never reads or forwards list. Two consequences, both happening before the nocookie domain-swap ever runs:

1. Paste a playlist page URL (youtube.com/playlist?list=...) — there's no v param at all, so the if is skipped and the raw, non-embeddable playlist page URL gets dropped straight into the iframe src. YouTube blocks that page from being framed, so it fails regardless of the nocookie setting.
2. Paste a "watch" URL that has both v and list (watch?v=X&list=Y) — only v survives; list is silently dropped, so you get the single video instead of the playlist.

The nocookie swap (ytNoCookies GDPR setting) is a simple domain-prefix regex on the already-built iframe HTML — it doesn't touch query params, so it's not actually the cause; it just happens to run after the real bug already broke the URL.

Workaround that works today: don't paste the playlist page URL. Paste the fully-formed embed URL directly:

https://www.youtube.com/embed/videoseries?list=PLAYLIST_ID

Since that URL has no v param either, youtubeIframe() leaves it untouched (url = code is never overwritten) and it passes straight through as-is — including correctly through the later nocookie domain-swap if you have that setting on.

Worth filing as its own bug against embed.js rather than closing as a nocookie issue, since it reproduces identically with the GDPR nocookie option off.

[dziudek]

@teezeh @ImMortaL0P - the problem will be fixed in v.0.48 planned for this month :)