WordPress.org
Get WordPress

Make WordPress Core

Opened 5 weeks ago

Last modified 3 weeks ago

#65190 new enhancement

Add komoot to the oEmbed provider allowlist

Reported by: federicofonta's profile federicofonta Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Embeds Keywords:
Focuses: Cc:

Description

komoot (​https://www.komoot.com) is a route-planning and outdoor navigation platform with public tour, smarttour, collection, and guide pages.

komoot now provides an oEmbed-compatible JSON endpoint:

​https://www.komoot.com/oembed

Supported URL examples:

The endpoint follows the oEmbed spec:

  • format=json
  • type=rich
  • returns html containing an iframe, width, height, provider_name, provider_url, cache_age
  • returns thumbnail_url for tour and smarttour embeds
  • sends Access-Control-Allow-Origin: *
  • sends cacheable responses via Cache-Control: public, max-age=3600, s-maxage=86400

Example request:

​https://www.komoot.com/oembed?url=https%3A%2F%2Fwww.komoot.com%2Ftour%2F2766645113&format=json

Example response includes:

<iframe src="https://www.komoot.com/tour/2766645113/embed?layout=classic&embed_source=oembed&profile=1" width="640" height="700" frameborder="0" scrolling="no" allowfullscreen referrerpolicy="strict-origin-when-cross-origin"></iframe>

Discovery tags are also present on canonical embeddable pages:

<link rel="alternate" type="application/json+oembed" href="https://www.komoot.com/oembed?url=..." title="..." />

Adding komoot to the trusted providers list would let WordPress users paste komoot URLs directly into the editor and get a rich route/collection/guide embed without installing a plugin.

Suggested provider pattern:

#https?://(www\.)?komoot\.(com|de|es|fr|it|nl|pl|jp|kr)/(tour|smarttour|collection|guide)/.*#i

Suggested endpoint:

https://www.komoot.com/oembed

How to test:

  1. Apply the provider allowlist patch.
  2. Open a new post in Gutenberg.
  3. Paste one supported komoot URL on its own line, for example:
  4. Confirm WordPress resolves the URL to an embed block.
  5. Confirm the front-end post output contains the iframe from the oEmbed response.

Change History (3)

#1 @sukhendu2002
5 weeks ago

Hi @federicofonta , welcome to WordPress Trac.

We have a dedicated oEmbed questionnaire. Can you please answer the questions from ​​Adding new oEmbed providers?

#2 @federicofonta
5 weeks ago

  • Type changed from defect (bug) to enhancement

Thanks @sukhendu2002!

Answers to the oEmbed provider questionnaire:

Is the service well-established, popular, and mainstream?

Yes. komoot is a long-running route-planning and outdoor navigation platform for hiking, cycling, bike touring, gravel, MTB, and running. It is widely used in Europe and internationally, with public route, smarttour, collection, and guide pages that are commonly linked from blogs, destination pages, tourism sites, clubs, and local businesses.

How does it compare to similar supported services?

For outdoor route/location content, komoot is comparable in role to other map/media providers already supported by WordPress oEmbed: it provides rich, interactive embeddable content that is useful in editorial posts and travel/outdoor guides. The embed is a hosted iframe, so WordPress sites do not need to run any komoot code directly.

Does the service have an established social media presence?

Yes. komoot maintains official channels and a broad user/community presence across major social platforms.

Is the oEmbed endpoint clearly established and documented?

Yes. The endpoint is live at:

​https://www.komoot.com/oembed

Example:

​https://www.komoot.com/oembed?url=https%3A%2F%2Fwww.komoot.com%2Ftour%2F2766645113&format=json

It follows the oEmbed JSON flow and returns type=rich, version=1.0, provider_name, provider_url, cache_age, width, height, and html containing an iframe. For tours and smarttours it also returns thumbnail fields.

Supported URL families are intentionally scoped to public embeddable content:

  • https://www.komoot.com/tour/<id>
  • https://www.komoot.com/smarttour/<id>
  • https://www.komoot.com/collection/<id>(/<slug>)?
  • https://www.komoot.com/guide/<id>(/<slug>)?

The endpoint also supports localized komoot TLDs and locale-prefixed paths.

Does the endpoint work with WordPress oEmbed auto-discovery?

Yes. Canonical embeddable pages include a discovery tag such as:

<link rel="alternate" type="application/json+oembed" href="https://www.komoot.com/oembed?url=..." title="..." />

This was verified in production on:

​https://www.komoot.com/tour/2766645113

The discovery tag is not rendered on iframe pages or noindex/private pages.

Does the service make an effort to build relationships with developers, such as through robust APIs?

Yes. komoot exposes public embed URLs and public share URLs for route/collection/guide content. The oEmbed endpoint was added specifically to support standard publishing workflows and avoid custom WordPress plugins or manual iframe copy-paste.

How old is the service?

komoot has been operating for well over a decade.

Does it have a well-established Wikipedia article?

Yes:

​https://en.wikipedia.org/wiki/Komoot

Has anyone written a WordPress plugin that leverages the service?

There are third-party WordPress plugins and site-specific integrations that embed or link komoot content, but the current common workflow is manual iframe copy-paste. Adding komoot as a trusted oEmbed provider would make this native for WordPress users and avoid per-site plugin requirements.

Is the provider frequently proposed?

This ticket is being opened by komoot after shipping and verifying a production oEmbed endpoint. The intended use case is common among travel/outdoor WordPress publishers: paste a public komoot route, smarttour, collection, or guide URL and get an interactive embed.

Security / trust notes

The oEmbed response returns a komoot-hosted iframe. The endpoint does not fetch arbitrary upstream data or proxy third-party HTML. It only accepts known komoot URL shapes and returns 404 for unsupported URLs, including highlights and user/profile pages. The iframe route remains the visibility/auth boundary for private or unavailable content.

Production smoke checks completed:

  • Tour oEmbed: 200
  • Tour discovery tag: present
  • Tour iframe route: 200
  • Collection oEmbed: 200
  • Guide oEmbed: 200
  • Highlight oEmbed: 404 as unsupported

#3 @federicofonta
3 weeks ago

Hi @sukhendu2002. Do you have any updates regarding this ticket?

Note: See TracTickets for help on using tickets.