Twitter oembeds include visitor tracking

[norcross]

Currently, Twitter adds a visitor tracking mechanism when tweets are embedded. They allow for sites to turn it off via a meta tag, or adding the dnt parameter to the embed request URL. This can be re-enabled using the existing oembed_fetch_url filter. Thanks to @joostdevalk for writing the code.

[norcross]

Additional line for adding the dnt argument

[joostdevalk]

+1, obviously. Seems such a simple way to prevent a lot of unnecessary tracking. Core doesn’t track visitors, why would we let other providers do that?

[joostdevalk]

Note that this works for more than just Twitter, it seems to be a pseudo standard, see for instance:

​http://docs.embed.ly/docs/oembed

[johnbillion]

+1 from me as long as it doesn't cause any of the other oEmbed providers to malfunction. I can't imagine it would, but it needs to be double checked. The tests in the patch on #32360 could be used to verify this, with a bit of persuading.

[norcross]

I pulled down the oembed test from #32360 and the testing results were identical when including the dnt flag, but another set of eyes would be helpful.

[boogah]

Replying to norcross:

I pulled down the oembed test from #32360 and the testing results were identical when including the dnt flag, but another set of eyes would be helpful.

I am also seeing identical output between the oEmbed tests on trunk and with @norcross's patch in place.

[kirasong]

Replying to johnbillion:

+1 from me as long as it doesn't cause any of the other oEmbed providers to malfunction. I can't imagine it would, but it needs to be double checked. The tests in the patch on #32360 could be used to verify this, with a bit of persuading.

+1 for doing this from me as well.

[matt]

This looks like a good change, let's get it in trunk and see if there are any unintended downsides.

[peterwilsoncc]

I'll aim for Monday AEST.

[netweb]

If the tests from # #32360 are going to be pulled in, please remove Vine before committing

The Vine oEmbed is being removed for 4.9 in #41817

[peterwilsoncc]

Replying to netweb:

If the tests from # #32360 are going to be pulled in, please remove Vine before committing

They've gone in once and were subsequently reverted as they were frequently throwing errors due to API limits and network issues. I'll use them to test locally but leave them as their own ticket.

[johnbillion]

@peterwilsoncc I spent the afternoon on Wednesday updating the tests in #32360 and I can confirm that adding the dnt parameter doesn't break tests for any of the providers.

I'll get this in.

[johnbillion]

In 41345:

Embeds: Add the dnt (Do Not Track) query parameter to all oEmbed provider URLs.

This means that, for those providers that support this somewhat de-facto standard, visitor tracking is disabled by default for all embeds.

Props norcross, joostdevalk

Fixes #41784