I was testing a video-preview link and unexpectedly got a version that displayed the whole webpage directly inside the post instead of showing only the video preview. Is this controlled by the page's metadata, do other platforms support this kind of embedding, and what security risks should I be aware of?
3 Answers
This is probably controlled by the page’s card metadata. A player-card setting tells the platform to load the URL specified as the player, so if that URL points to a full webpage, the platform may embed the entire page. For a normal preview, use a summary card with an image, or create a stripped-down player page containing only the video.
An iframe can be reasonably safe when it is sandboxed and isolated with a strict content security policy, but you should not assume every platform handles it perfectly. Without proper restrictions, embedded pages can create clickjacking, unwanted script execution, navigation, or data-leak risks. Platforms may also limit which sites can be embedded or rely on the metadata supplied by the page.
The concern is that full-page embedding gives a third-party site much more control over what appears inside the post. It is less risky when the embedded document is isolated and stripped down, but a dedicated player page is still the better design than exposing the entire site.
That explains it—I was pointing the player URL at the regular page instead of a dedicated video-only view.