The YouTube embed feature (image/link syntax → iframe player; CSP already allowlists youtube.com/youtube-nocookie.com in frame-src) currently renders a silent 16:9 blank box on macOS. No error is surfaced; users cannot tell why.
Root cause
Since late 2025 YouTube's embedded player refuses to initialize unless the request identifies its embedding origin via the Referer header ("Error 153: Video player configuration error"). This broke many regular websites too (Simon Willison's writeup). Websites can fix it with Referrer-Policy: strict-origin-when-cross-origin — but Markpad cannot: on macOS/Linux the page origin is tauri://localhost, and browsers never send a Referer from non-http(s) origins. There is nothing to send.
Experiment matrix (macOS, same video, network confirmed fine):
| parent page |
Referer sent |
result |
http://127.0.0.1 test page |
yes |
✅ plays |
direct navigation to /embed/… |
none |
❌ error 153 |
file:// test page |
none (spec-forbidden) |
❌ error 153 |
Markpad (tauri://localhost) |
none (spec-forbidden) |
❌ blank box |
Open question for maintainers: does Windows still work?
On Windows WebView2 the origin is http://tauri.localhost — a legit http origin that does send a Referer, so the feature may still be alive there. Worth a quick test before deciding scope.
Options
- Degrade to thumbnail + open-externally (suggested): render
https://img.youtube.com/vi/<id>/hqdefault.jpg (already allowed by img-src https:, works without Referer) and open the video in the system browser on click. Predictable, immune to future policy changes; could be macOS/Linux-only if Windows embeds still work.
- Remove the feature: links stay links. Also allows dropping
frame-src entirely — the embed iframe is the only external-code execution point in the preview webview.
useHttpsScheme (Tauri v2) to make the origin https://tauri.localhost so a Referer exists. Heavy caveat: localStorage is partitioned by origin, so all existing users would silently lose settings/recent-files/session state unless a migration is shipped.
Happy to send a PR once maintainers pick a direction (and report Windows status).
The YouTube embed feature (image/link syntax → iframe player; CSP already allowlists
youtube.com/youtube-nocookie.cominframe-src) currently renders a silent 16:9 blank box on macOS. No error is surfaced; users cannot tell why.Root cause
Since late 2025 YouTube's embedded player refuses to initialize unless the request identifies its embedding origin via the
Refererheader ("Error 153: Video player configuration error"). This broke many regular websites too (Simon Willison's writeup). Websites can fix it withReferrer-Policy: strict-origin-when-cross-origin— but Markpad cannot: on macOS/Linux the page origin istauri://localhost, and browsers never send a Referer from non-http(s) origins. There is nothing to send.Experiment matrix (macOS, same video, network confirmed fine):
http://127.0.0.1test page/embed/…file://test pagetauri://localhost)Open question for maintainers: does Windows still work?
On Windows WebView2 the origin is
http://tauri.localhost— a legit http origin that does send a Referer, so the feature may still be alive there. Worth a quick test before deciding scope.Options
https://img.youtube.com/vi/<id>/hqdefault.jpg(already allowed byimg-src https:, works without Referer) and open the video in the system browser on click. Predictable, immune to future policy changes; could be macOS/Linux-only if Windows embeds still work.frame-srcentirely — the embed iframe is the only external-code execution point in the preview webview.useHttpsScheme(Tauri v2) to make the originhttps://tauri.localhostso a Referer exists. Heavy caveat: localStorage is partitioned by origin, so all existing users would silently lose settings/recent-files/session state unless a migration is shipped.Happy to send a PR once maintainers pick a direction (and report Windows status).