YouTube no longer responds with xml or json body on private videos

[bascht]

Stumbled upon this behaviour via a Drupal bug report but this is slightly different: I was hunting down a OEmbed::ParseError which is probably rooted in a change on YouTubes side: From what I can tell from my own testing, YouTube will no longer respond with a formatted body to oembed requests for private videos.

I tested with https://www.youtube.com/oembed/?scheme=https&url=https://www.youtube.com/watch?v=ejCiG0swM24&format=json which will now respond with just Forbidden as body text (and HTTP 200 😖)

Whereas existing videos can be embedded just fine, since they will responde in their proper format, e.g. https://www.youtube.com/oembed/?scheme=https&url=https://www.youtube.com/watch?v=MPY_EuvimH0&format=json

---

I am not sure where to go from here. As far as I understand the spec, responses should be either valid json or xml and even the HTTP response doesn't give any hints on the failure mode. 😟

Let me know if I can help to debug this further.

[metavida]

Yup! Definitely seems like a bug on the YouTube side of things. There does seem to be a quick, hacky fix! For whatever reason, if there's a trailing slash in the YouTube oembed endpoint, then their servers correctly return a 403 Forbidden status for private videos!

- https://www.youtube.com/oembed?url=
+ https://www.youtube.com/oembed/?url=

I'll work on getting a PR for this gem with some tests in place. In the short term, assuming you use the built-in YouTube provider, you can add the following near where your app starts, after the gem is loaded:

OEmbed::Providers::Youtube.endpoint = 'https://www.youtube.com/oembed/?scheme=https'

With that patch in place (and/or once I get the built-in provider updated) you should get an OEmbed::UnknownResponse error for private video URLs. Specifically OEmbed::UnknownResponse (Got unknown response (403) from server)

[metavida]

Version 0.14.1 is now live! Give it a try and let me know how it works.