From 1c9a5e428302c46b0472b62fa34b396762352575 Mon Sep 17 00:00:00 2001
From: Erik Michelson <github@erik.michelson.eu>
Date: Mon, 24 Nov 2025 14:14:45 +0100
Subject: [PATCH] fix(embeddings): YouTube embedding requires referrer

The embedded YouTube player seemed not to work anymore
and showed a warning "invalid player configuration".
This seems to be related to the iframe being loaded
without a referrer to the origin domain. YouTube
nowadays requires this (probably to track from which
domains a YouTube player is embedded).

See also: https://developers.google.com/youtube/terms/required-minimum-functionality#embedded-player-api-client-identity

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
---
 public/docs/release-notes.md | 1 +
 public/js/extra.js           | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/public/docs/release-notes.md b/public/docs/release-notes.md
index 8c457e33..fcdd91f1 100644
--- a/public/docs/release-notes.md
+++ b/public/docs/release-notes.md
@@ -12,6 +12,7 @@
 
 ### Bugfixes
 - Ignore the healthcheck endpoint in the "too busy" limiter
+- Send the referrer origin for YouTube embeddings due to their requirement 
 
 ## <i class="fa fa-tag"></i> 1.10.3 <i class="fa fa-calendar-o"></i> 2025-04-09
 
diff --git a/public/js/extra.js b/public/js/extra.js
index 60830699..f6be7b6b 100644
--- a/public/js/extra.js
+++ b/public/js/extra.js
@@ -816,7 +816,7 @@ export function smoothHashScroll () {
 
 function imgPlayiframe (element, src) {
   if (!$(element).attr('data-videoid')) return
-  const iframe = $("<iframe style='border: none' allowfullscreen></iframe>")
+  const iframe = $('<iframe style="border: none" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>')
   $(iframe).attr('src', `${src + $(element).attr('data-videoid')}?autoplay=1`)
   $(element).find('img').css('visibility', 'hidden')
   $(element).append(iframe)