[Webkit-unassigned] [Bug 20739] New: Youku.com flash video does not play when it's embedded in a 3rd party web page

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=20739

           Summary: Youku.com flash video does not play when it's embedded
                    in a 3rd party web page
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
               URL: http://www.oneava.cn/read.php?tid=49
        OS/Version: All
            Status: UNCONFIRMED
          Severity: Normal
          Priority: P2
         Component: Plug-ins
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: agiyengar at yahoo.com


Youku.com is #1 youtube-like site in China. 

------------------------
What steps will reproduce the problem?
1. go to http://www.oneava.cn/read.php?tid=49
2. wait a a few seconds
3. press a large play button in the middle of 'flash' frame 

What is the expected output? What do you see instead?

Flash movie should be played. Instead, we get an error message in Chinese.

---------------------
Here are the headers caught with Google Chrome/Opera/Safari on Mac

060.247.104.099.07961-059.175.133.025.00080: GET 
/19678964764/020064010048425D28CABD00380F414E90E8FF-9EB6-4DCF-0858-
C5378F42C4EC.flv HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) 
AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13
Referer: http://www.oneava.cn/read.php?tid=49
Accept: */*
Accept-Language: zh-CN,zh
Accept-Charset: gb18030,*,utf-8
Accept-Encoding: gzip,deflate,bzip2
Host: 59.175.133.25
Connection: Keep-Alive

Here are IE's headers:

060.163.233.090.03560-059.175.133.025.00080: GET 
/196f7764764/020064070047241199C96F0048CFA690E8D0F3-B2A8-7E99-061C-
C5114F6C4B05.flv?start=170 HTTP/1.1
Accept: */*
Accept-Language: zh-CN
Referer: http://static.youku.com/v1.0.0320/v/swf/qplayer.swf
x-flash-version: 9,0,124,0
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Connection: Keep-Alive
Host: 59.175.133.25

Basically they need to check the referer to make sure the request comes 
from the flash they created, instead of a download link. IE gives referer 
as the url of flash swf, while the referer in Safari(Mac), gives the url of the
page, which fails their check.

Some more info

The value of Referer: field is different in different browsers. There's a
recent mail from an Opera engineer about the issue in NPAPI plugin-future
mailing list. (I can't give a url because the archive is protected).  

The gist of that email is :

IE7/IE8 : sends the URL of the requesting plug-in 
Firefox3: does not send a referer (except in a very special case : [3])
Safari 3.1 (Windows) : does not send a referer
Safari 3.1 (Mac) : sends the embedding page URL.
Google Chrome : sends the embedding page URL
Opera : sends the embedding page URL

Other related links are :
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=410904
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=383708
[3] http://www.actionscript.org/forums/showthread.php3?t=164503

Should webkit attempt to match IE's behavior and always set the default referer
to the plugin URL?


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.