Add Bluesky (bsky.app) to oEmbed allowlist

[bnewboldbsky]

Bluesky recently added public embed support for individual posts, including oEmbed discovery.

oEmbed endpoint: ​https://embed.bsky.app/oembed
URL pattern: ​https://bsky.app/profile/*/post/*

There is a tool to experiment with embeds at ​https://embed.bsky.app

I looked over the "adding new oEmbed providers" questions (​https://make.wordpress.org/core/handbook/contribute/design-decisions/#adding-new-oembed-providers). Bluesky currently has over 5 million registered accounts, and over a million active users. There is a wikipedia article (​https://en.wikipedia.org/wiki/Bluesky_(social_network)). The protocol that Bluesky is built on, atproto, is federated. bsky.app is not the only domain/website which can publicly display or embed posts, but it is a large and stable provider for the entire network (including content which is hosted on independent instances). We take the responsibility of hosting embeds pretty seriously, and expect to support this endpoint, and embeds, in a backwards-compatible manner indefinitely, to the best of our ability.

The source code for the embed widget and embed.bsky.app server are both open source: ​https://github.com/bluesky-social/social-app

I will be opening an issue to get Bluesky added to the public provider list (​https://oembed.com/providers.json) in parallel to this ticket.

[swissspidy]

Hi there and welcome to WordPress Trac!

Would you mind filling out the whole questionnaire?

[bnewboldbsky]

Sure!

Is the service is popular enough for core developers to have heard of it before? Is it “mainstream?”

Hope so! We have had a fair amount of general press and tech press coverage in the past year. It is a growing, general-purpose social network.

If similar services are already supported, how does this service compare in terms of size, features, and backing?

Bluesky is certainly smaller than incumbent social media platforms like Facebook or Instagram, but is one of the largest and healthiest new services in the current post-Twitter-acquisition era.

Does this service have an established social media presence?

Yes.

Is its oEmbed endpoint clearly established and properly documented? (Sometimes, they are just a developer’s pet project that may not be supported.)

The oEmbed endpoint is new, but official and part of the core service.

Does the oEmbed endpoint work with WordPress’ oEmbed auto-discovery? If not, could it be made to work with additional HTML tags or attributes being added to the allow-list?

The WordPress auto-discovery seems to pick up the oEmbed discovery reference, but the widget does not execute correctly. Microblogging posts are simple in theory, but notoriously difficult to render consistently.

Does the service make an effort to build relationships with developers, such as through robust APIs?

I hope so! Bluesky is built on the atproto protocol; the "API" is the protocol itself, which in most cases functions as a simple HTTP+JSON API. Documentation at ​https://docs.bksy.app

How old is the service?

Bluesky the company is a couple years old. We have been out of "beta" for a few months (open signup). The embed service was launched last week.

Does it have a well-established Wikipedia article? (Seriously.)

​https://en.wikipedia.org/wiki/Bluesky_(social_network)

Has anyone written a WordPress plugin that leverages the service in some way, whether adding it as an oEmbed provider, creating a shortcode, or leveraging other APIs of the service? Do these plugins have any noticeable adoption or traction that would indicate usage and demand?

I believe there are one or more wordpress plugins to cross-post to Bluesky/atproto. It looks like there are some tickets for other integrations, like adding a Bluesky profile link to wordpress account profiles; share buttons for readers; etc.

eg: ​https://github.com/Automattic/jetpack/issues/30460

Is the provider frequently proposed?

I'm not sure how to answer this one.

[swissspidy]

Does this service have an established social media presence?

Just for completeness sake:

​~900k followers on Bluesky itself
​~300k followers on Twitter/X.

Is its oEmbed endpoint clearly established and properly documented? (Sometimes, they are just a developer’s pet project that may not be supported.)

The oEmbed endpoint is new, but official and part of the core service.

I couldn't find any documentation at ​https://docs.bsky.app/ about the oEmbed endpoint.

I suggest adding some :)

Does the oEmbed endpoint work with WordPress’ oEmbed auto-discovery? If not, could it be made to work with additional HTML tags or attributes being added to the allow-list?

I just tested this post: ​https://bsky.app/profile/bsky.app/post/3kqjaq2begs2s

The oEmbed endpoint referenced in the HTML seems to be: ​https://embed.bsky.app/oembed?format=json&url=at%3A%2F%2Fdid%3Aplc%3Az72i7hdynmk6r22z27h6tvur%2Fapp.bsky.feed.post%2F3kqjaq2begs2s

The post can't be embedded right now because WordPress passes maxwidth=600 and maxheight=750 by default, but this is not supported by Bluesky. So the requested https://embed.bsky.app/oembed?format=json&url=https%3A%2F%2Fbsky.app%2Fprofile%2Fbsky.app%2Fpost%2F3kqjaq2begs2s&maxwidth=600&maxheight=750&dnt=1 URL leads to a HTTP 400 response saying "Invalid maxwidth (expected integer between 220 and 550)".

Minor detail: Also looks like maxheight is not respected. And the returned height is always null.

@bnewboldbsky My suggestion: don't return an error for out-of-bounds maxwidth, just silently enforce the minimum and maximum. So if a consumer like WP passes maxwidth=600 and you return an embed with width 550, that's totally fine.

[bnewboldbsky]

Thanks for the reply, and sorry for the slow reply (account was locked).

I updated the oemebd endpoint to not error out due to maxwidth out-of-range, and also updated the default to a width of 600 at the same time.

Also added a documentation page at: ​https://docs.bsky.app/docs/advanced-guides/oembed

[swissspidy]

Awesome, thanks, looks much better now!

WP is at least not erroring now, but the returned oEmbed HTML is still sanitized by WordPress because the provider is untrusted.

I think it makes sense to add Bluesky to the allowlist. Moving to 6.6 milestone for consideration.

Trac ticket: https://core.trac.wordpress.org/ticket/61020

[peterwilsoncc]

For authorized embed providers, a embed variation block is typically added to the Gutenberg editor in the ​WordPress/Gutenberg repo on GitHub.

Some prior art can bee seen with this pull request ​adding a Pocket Casts block.

@bnewboldbsky For this purpose, are you able to provide an optimized SVG of the Bluesky logo?

[peterwilsoncc]

The ​linked pull request looks good for commit, marking the ticket as such.

I've noticed the parameter ref_url is added to all of the links in embeds. I guess this is fine for links to Bluesky itself, I'm not sure it's great to include it on links to third party sites (for example in the embed for this ​post's link to bbc.co.uk) as it includes information a site's visitor may wish to exclude if they are visiting a part of the internet that encourages privacy.

I don't think it's a blocker though.

[bnewboldbsky]

Sure, we have small logo SVG here: ​https://github.com/bluesky-social/social-app/blob/main/bskyembed/assets/logo.svg

[swissspidy]

In 58091:

Embeds: Add Bluesky as a trusted oEmbed provider.

Props swissspidy, thelovekesh, peterwilsoncc, bnewboldbsky.
Fixes #61020.

Committed in https://core.trac.wordpress.org/changeset/58091