Bug 20739 – Youku.com flash video does not play when it's embedded in a 3rd party web page (Referrer not sent?)

• Component: Plug-ins
• Status: RESOLVED WONTFIX

[Ananta]

Youku.com is #1 youtube-like site in China. 

------------------------
What steps will reproduce the problem?
1. go to http://www.oneava.cn/read.php?tid=49
2. wait a a few seconds
3. press a large play button in the middle of 'flash' frame 

What is the expected output? What do you see instead?

Flash movie should be played. Instead, we get an error message in Chinese.

---------------------
Here are the headers caught with Google Chrome/Opera/Safari on Mac

060.247.104.099.07961-059.175.133.025.00080: GET 
/19678964764/020064010048425D28CABD00380F414E90E8FF-9EB6-4DCF-0858-
C5378F42C4EC.flv HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) 
AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13
Referer: http://www.oneava.cn/read.php?tid=49
Accept: */*
Accept-Language: zh-CN,zh
Accept-Charset: gb18030,*,utf-8
Accept-Encoding: gzip,deflate,bzip2
Host: 59.175.133.25
Connection: Keep-Alive

Here are IE's headers:

060.163.233.090.03560-059.175.133.025.00080: GET 
/196f7764764/020064070047241199C96F0048CFA690E8D0F3-B2A8-7E99-061C-
C5114F6C4B05.flv?start=170 HTTP/1.1
Accept: */*
Accept-Language: zh-CN
Referer: http://static.youku.com/v1.0.0320/v/swf/qplayer.swf
x-flash-version: 9,0,124,0
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Connection: Keep-Alive
Host: 59.175.133.25

Basically they need to check the referer to make sure the request comes 
from the flash they created, instead of a download link. IE gives referer 
as the url of flash swf, while the referer in Safari(Mac), gives the url of the page, which fails their check.

Some more info

The value of Referer: field is different in different browsers. There's a recent mail from an Opera engineer about the issue in NPAPI plugin-future mailing list. (I can't give a url because the archive is protected).  

The gist of that email is :

IE7/IE8 : sends the URL of the requesting plug-in 
Firefox3: does not send a referer (except in a very special case : [3])
Safari 3.1 (Windows) : does not send a referer
Safari 3.1 (Mac) : sends the embedding page URL.
Google Chrome : sends the embedding page URL
Opera : sends the embedding page URL

Other related links are :
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=410904
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=383708
[3] http://www.actionscript.org/forums/showthread.php3?t=164503

Should webkit attempt to match IE's behavior and always set the default referer
to the plugin URL?

[Mariusz Lusiak]

Is there any update on this?

The misleading behavior of Safari is still present in version 4.0.5. The Mac version does send a referrer for embedded flash whereas the Windows version doesn't. Is it going to be unified in some way?

[Alexey Proskuryakov]

This bug is about the youku.com failure specifically, but the example URL is not accessible now.

The difference between Mac and Windows may or may not the cause, and may or may not be a WebKit issue (it's possible for the Flash plug-in itself to do something different). So, while these issues are probably related, it's better to not conflate them.

[Ahmad Saleem]

Adobe Flash is not in support and NPAPI plugins are not supported from Safari 14 onward. Can this be marked as "RESOLVED WONTFIX"? Thanks!

[Radar WebKit Bug Importer]

<rdar://problem/95545887>