Twitter embed video in Discord

[Zelmanyr]

BEFORE YOU BEGIN

I have attempted the following troubleshooting suggestions:

• [ x] Cleared website data, restarted Firefox, and my issue persists.
• [ x] No issues when using the website or extension in another web browser.
• [ x] The issue persists when using Firefox in Safe Mode.
• [x ] Disabled DNS-level content blocking (AdGuard, NextDNS, PiHole), cleared my DNS cache, and used my ISP's DNS resolver (if applicable).

REPORT

Describe the bug
Tracking Protection is blocking Twitter embed video in Discord from playing. When disabling that protection, the video plays just fine.

To Reproduce
Steps to reproduce the behavior:

1. Go to 'Discord'
2. Log in to your account.
3. Paste and send a twitter video link to one of your friend.
4. Try clicking the play button
5. Nothing is playing

Expected behavior
The Twitter embed video is playing just fine in Discord.

Screenshots
https://i.imgur.com/6dC2kxK.png
And this is when I click the play button, nothing is happening
https://i.imgur.com/VlFwWP2.png

Desktop (please complete the following information):

• OS : Windows 10 22H2
• Browser : Firefox
• Version : 103.0.2 x64

Additional context
The test link for twitter embed post (https://www.newsweek.com/cryptic-tweet-britney-spears-shows-elton-john-collab-may-date-back-2015-1728036) contain a embed twitter video which is playing just fine. However, It's not the case with Discord and embed Twitter video.

To go further, when disabling Tracking Protection, the embed Twitter video plays just fine in Discord. To me, that means the Tracking Protection is blocking embed Twitter video in Discord for some reason.

[yokoffing]

Thanks for reporting the issue! I'm always fascinated by inconsistencies like this one.

when disabling Tracking Protection, the embed Twitter video plays just fine in Discord

I cannot reproduce your workaround. Disabling Tracking Protection outright still fails to play the embed. In fact, the same behavior occurs with:

• Brave with Allow Twitter embedded tweets enabled and Shields disabled
• Microsoft Edge w/ Basic Tracking Prevention and allowing 3rd party cookies
• Chrome
• Discord app for Windows 11 on another computer, using a different account
• On the Discord app for iOS: a preview of the tweet shows but not the media player portion, unlike it does for Discord on desktops

The tweet preview in Discord is coming from twitter.com, abs.twimg.com, and api.twitter.com, whereas embedded tweet widgets on webpages comes from platform.twitter.com. The request type is different, too.

I had to add twitter.com to our two urlclassifier pref strings from SecureFox so that the twitter.com and abs.twimg.com requests would not be blocked by Firefox's Tracking Protection. But doing that, and even disabling TP outright, didn't change anything.

The third request the tweet preview calls for, api.twitter.com, is flagged by CORS in all the aforementioned web browsers I tested. It's only allowed to load on twitter.com; no other websites. And if that's what's needed for the tweet preview to play, then this would explain why it didn't work on any other browsers I tested:

You can read more about CORS below:

• https://portswigger.net/web-security/cors
• https://medium.com/@electra_chong/what-is-cors-what-is-it-used-for-308cafa4df1a
• https://www.keycdn.com/support/cors#a-real-world-example-of-how-cors-works

If more users report that they can play with Tracking Protection disabled, we can look dig further into the breakage.

[Zelmanyr]

Hi,
I just tried with a fresh firefox profile, and it didn't play the video. However, after disabling Tracking Protection, it just played fine. Same with Arkenfox user.js. I would like to know, can we disable tracking protection completely and only rely on ublock origin ? What do we lose if we do that ? I would prefer relying on ublock origin since it is way more customizable than tracking protection for me.

EDIT : Just tried Librewolf, same thing, same workaround.

[yokoffing]

I still am not able to reproduce the solution. I tried again on a fresh Firefox Nightly profile on my work network (which doesn't use NextDNS like my home network). Didn't use uBO or TP; still didn't fetch the video.

One option you can try without disabling Tracking Protection: Add twitter.com to your two urlclassifier prefs. They should look like this after adding:

user_pref("urlclassifier.trackingSkipURLs", "*.reddit.com, *.twitter.com, *.twimg.com, twitter.com");
user_pref("urlclassifier.features.socialtracking.skipURLs", "*.instagram.com, *.twitter.com, *.twimg.com, twitter.com");

If that still doesn't work: You can disable Tracking Protection for https://discord.com in the Firefox settings, if Twitter video previews are that frequent for your usecase.

can we disable tracking protection completely and only rely on ublock origin ?

I don't advise that. You can use both, and Tracking Protection goes beyond blocking certain requests. You can always disable Tracking Protection for certain sites, but I never need to.

[yokoffing]

Archiving for now.