fix(docs-infra): use a facade for docs-video to fix Firefox embeds#69298
Open
erkamyaman wants to merge 1 commit into
Open
fix(docs-infra): use a facade for docs-video to fix Firefox embeds#69298erkamyaman wants to merge 1 commit into
erkamyaman wants to merge 1 commit into
Conversation
Follow-up to angular#69205. After switching adev's COEP to `credentialless`, the cross-origin YouTube iframe in `<docs-video>` loads in Chromium and Safari but not Firefox, whose `credentialless` policy does not extend to nested frames. The result was a COEP error screen instead of the player. Render `<docs-video>` as a lightweight thumbnail facade instead of embedding the iframe directly. The thumbnail is a cross-origin subresource, so it loads under `credentialless` in every browser. `DocViewer` then upgrades the facade to the inline player on hydration in browsers that can load the embed (Chromium, Safari), preserving the previous behavior there. On Firefox the facade stays a plain link that opens the video on YouTube (with autoplay), which replaces the error screen. The thumbnail uses `maxresdefault` and falls back to `hqdefault` when a video has no max-resolution image.
Contributor
Author
|
could you please run the preview tests? @JeanMeche |
|
Deployed adev-preview for 1eb3fc1 to: https://ng-dev-previews-fw--pr-angular-angular-69298-adev-prev-twsgdov0.web.app Note: As new commits are pushed to this pull request, this link is updated after the preview is rebuilt. |
SkyZeroZx
reviewed
Jun 11, 2026
| } | ||
|
|
||
| private setupVideoFacades(element: HTMLElement): void { | ||
| const isFirefox = /firefox/i.test(this.document.defaultView?.navigator.userAgent ?? ''); |
Contributor
There was a problem hiding this comment.
NIT:
We can use isFirefox from
angular/adev/shared-docs/utils/device.utils.ts
Lines 23 to 25 in 71bb19d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #69205. After switching adev's COEP to
credentialless, thecross-origin YouTube iframe in
<docs-video>loads in Chromium and Safari butnot Firefox, whose
credentiallesspolicy does not extend to nested frames. Theresult was a COEP error screen instead of the player.
Render
<docs-video>as a lightweight thumbnail facade instead of embedding theiframe directly. The thumbnail is a cross-origin subresource, so it loads under
credentiallessin every browser.DocViewerthen upgrades the facade to theinline player on hydration in browsers that can load the embed (Chromium,
Safari), preserving the previous behavior there. On Firefox the facade stays a
plain link that opens the video on YouTube (with autoplay), which replaces the
error screen.
The thumbnail uses
maxresdefaultand falls back tohqdefaultwhen a videohas no max-resolution image.
PR Checklist
Please check to confirm your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
Follow-up to #69205 (see also #55310). adev is cross-origin isolated with
COEP: credentialless. The cross-origin YouTube iframe in<docs-video>loadsin Chromium and Safari, but Firefox's
credentiallesspolicy does not covernested frames, so the embed is blocked and the reader sees a COEP error screen
instead of the video.
What is the new behavior?
<docs-video>now renders a lightweight thumbnail facade (a YouTube posterimage plus a play button) rather than embedding the iframe directly:
credentiallessin every browser, including Firefox.DocViewerswaps the facade for the inline iframe in browsersthat can load the embed (Chromium, Safari), using the same iframe attributes
as before, so their behavior is unchanged.
autoplay=1), replacing the error screen.maxresdefaultand falls back tohqdefaultwhen avideo lacks a max-resolution image.
Does this PR introduce a breaking change?