Embedded tweets don't show in Chrome, Firefox on a desktop

[tobase]

Forum URL: (private)

Just confirming that embeds from Twitter are a problem for some users of certain browsers. They're invisible to me using Google Chrome v. 63.0.3239.132 under MacOS X 10.11.6 El Capitan (desktop installation). 

• I also see the same problem in Firefox 54.0.1 with Basic Page Style enabled and no funny plugins or preferences

• The problem doesn't exist for Apple's Safari browser

• Ditto the mobile version of Chrome, it renders Twitter embeds just fine from an iPhone using WiFi to the same home network.


I didn't turn on Reader View or anything else that would suppress some page elements. I'm doing everything the same as I did before I stumbled on the issue, maybe ~10 days ago? Don't exactly know about the timing. 

[Michael]

Hi,

We've had multiple reports about this now but so far nobody has been able to link us to an embed that doesn't work or provide us with a replicatable test. I am running the same version of Chrome that you are and the tweets show up just fine for me. Have you tried private browsing mode to see if they display for you there?

At this point I'm completely confused. Could you check to see if you have any console errors that would indicate what the problem is? Hit F12 on a page where a tweet isn't displaying and copy all of that information into a post here.

[tobase]

F12 gets me nowhere, but this comes from Developer : JavaScript Console (verbose)...

==============

Page URL: shonenknife.proboards.com/thread/680/oreskaband?page=3&scrollTo=20540

==============

Uncaught DOMException: Failed to read the 'localStorage' property from 'Window': Access is denied for this document.
at o (https://platform.twitter.com/widgets/widget_iframe.9c00c8ca14a8618c4db8e2c43139b138.html?origin=http%3A%2F%2Fshonenknife.proboards.com:12:6652)
at Object.<anonymous> (https://platform.twitter.com/widgets/widget_iframe.9c00c8ca14a8618c4db8e2c43139b138.html?origin=http%3A%2F%2Fshonenknife.proboards.com:12:6796)
at n (https://platform.twitter.com/widgets/widget_iframe.9c00c8ca14a8618c4db8e2c43139b138.html?origin=http%3A%2F%2Fshonenknife.proboards.com:5:246)
at Object.<anonymous> (https://platform.twitter.com/widgets/widget_iframe.9c00c8ca14a8618c4db8e2c43139b138.html?origin=http%3A%2F%2Fshonenknife.proboards.com:5:395)
at n (https://platform.twitter.com/widgets/widget_iframe.9c00c8ca14a8618c4db8e2c43139b138.html?origin=http%3A%2F%2Fshonenknife.proboards.com:5:246)
at platform.twitter.com/widgets/widget_iframe.9c00c8ca14a8618c4db8e2c43139b138.html?origin=http%3A%2F%2Fshonenknife.proboards.com:5:362
at platform.twitter.com/widgets/widget_iframe.9c00c8ca14a8618c4db8e2c43139b138.html?origin=http%3A%2F%2Fshonenknife.proboards.com:5:367
at platform.twitter.com/widgets/widget_iframe.9c00c8ca14a8618c4db8e2c43139b138.html?origin=http%3A%2F%2Fshonenknife.proboards.com:12:10018

combined.js:10
[Violation] Avoid using document.write().
y.renderAd @ combined.js:10
value @ combined.js:5
(anonymous) @ combined.js:18


2VM160 tags.js:804
[Violation] Avoid using document.write().
includeJScript @ VM160 tags.js:804
init @ VM160 tags.js:698
(anonymous) @ VM160 tags.js:2047
(anonymous) @ VM160 tags.js:2050


2VM160 tags.js:1660
[Violation] Avoid using document.write().
drawTags @ VM160 tags.js:1660
displayAd @ VM160 tags.js:1529
displayAdFromAdSpec @ VM160 tags.js:824
displayAdFromE9 @ VM160 tags.js:815
displayAdFromE9 @ VM160 tags.js:627
fetchAd @ VM161 displayAd.js?dver=0.8&th=8738219280:30
(anonymous) @ VM161 displayAd.js?dver=0.8&th=8738219280:44


VM162 j.ad?flashVer=0&ver=1.28&th=8738219280&tagKey=1465300188&site=proboardscommobile&adSpace=mobile¢er=1&env=display&size=320x50&busted=1&url=http%3A%2F%2Fshonenknife.proboards.com%2Fthread%2F680%2Foreskaband%3Fpage%3D3%26scrollTo%3D20540&f=1&p=16277136&tKey=acmneMWcfkRPJNTdMTUbf5QVADRiDrmZb&a=1&adContainerId=richmedia_2&rnd=16276126:1
[Violation] Avoid using document.write().
(anonymous) @ VM162 j.ad?flashVer=0&ver=1.28&th=8738219280&tagKey=1465300188&site=proboardscommobile&adSpace=mobile¢er=1&env=display&size=320x50&busted=1&url=http%3A%2F%2Fshonenknife.proboards.com%2Fthread%2F680%2Foreskaband%3Fpage%3D3%26scrollTo%3D20540&f=1&p=16277136&tKey=acmneMWcfkRPJNTdMTUbf5QVADRiDrmZb&a=1&adContainerId=richmedia_2&rnd=16276126:1


VM164 casaleRJTag.js:7
[Violation] Avoid using document.write().
casaleCall @ VM164 casaleRJTag.js:7
(anonymous) @ VM164 casaleRJTag.js:27


VM164 casaleRJTag.js:20
[Violation] Avoid using document.write().
casaleCall @ VM164 casaleRJTag.js:20
(anonymous) @ VM164 casaleRJTag.js:27


VM165 j?s=140206&a=10&id=392273628&p=0&v=2&inif=1&d=CasaleArgs.pubDefault&l=0&t=0&w=1916&h=1177&z=480&u=http%3A%2F%2Fshonenknife.proboards.com%2F%2311153482&dr=1&C=1:1
[Violation] Avoid using document.write().
(anonymous) @ VM165 j?s=140206&a=10&id=392273628&p=0&v=2&inif=1&d=CasaleArgs.pubDefault&l=0&t=0&w=1916&h=1177&z=480&u=http%3A%2F%2Fshonenknife.proboards.com%2F%2311153482&dr=1&C=1:1


VM165 j?s=140206&a=10&id=392273628&p=0&v=2&inif=1&d=CasaleArgs.pubDefault&l=0&t=0&w=1916&h=1177&z=480&u=http%3A%2F%2Fshonenknife.proboards.com%2F%2311153482&dr=1&C=1:1
[Violation] Avoid using document.write().
(anonymous) @ VM165 j?s=140206&a=10&id=392273628&p=0&v=2&inif=1&d=CasaleArgs.pubDefault&l=0&t=0&w=1916&h=1177&z=480&u=http%3A%2F%2Fshonenknife.proboards.com%2F%2311153482&dr=1&C=1:1


VM166 j.ad?passBackID=11153482&flashVer=0&ver=1.28&th=8738219280&tagKey=1465300188&site=proboardscommobile&adSpace=mobile¢er=1&env=display&size=320x50&busted=1&url=http%3A%2F%2Fshonenknife.proboards.com%2Fthread%2F680%2Foreskaband%3Fpage%3D3%26scrollTo%3D20540&f=1&p=16277136&tKey=acmneMWcfkRPJNTdMTUbf5QVADRiDrmZb&a=1&adContainerId=richmedia_2&rnd=16276126:1
[Violation] Avoid using document.write().
(anonymous) @ VM166 j.ad?passBackID=11153482&flashVer=0&ver=1.28&th=8738219280&tagKey=1465300188&site=proboardscommobile&adSpace=mobile¢er=1&env=display&size=320x50&busted=1&url=http%3A%2F%2Fshonenknife.proboards.com%2Fthread%2F680%2Foreskaband%3Fpage%3D3%26scrollTo%3D20540&f=1&p=16277136&tKey=acmneMWcfkRPJNTdMTUbf5QVADRiDrmZb&a=1&adContainerId=richmedia_2&rnd=16276126:1


default-320x50.html:20
[Violation] Avoid using document.write().
(anonymous) @ default-320x50.html:20

[Michael]

Hi,

This log indicates that your browser is blocking the embeds. Are you using Adblock, UBlockOrigin, or any other type of ad-blocker?

Alternatively make sure that you have third-party cookies and site data unblocked. 

[tobase]

Just FYI, no change in Chrome's behavior when logging in from a fresh Incognito browser window with no other tabs open.


The summary of Chrome's browser settings that apply to the page looks like this...

[Ulises]

tobase In Chrome copy/paste the following into your URL bar: chrome://settings/content/cookies

and make sure Allow sites to save and read cookie data (recommended) looks like this:

[tobase]

Sorry, our messages crossed. I don't use any ad blockers, but 3rd-party cookies have been turned off as long as I can remember. Testing now with all the cookies enabled...

[tobase]

Yeah, enabling 3rd-party cookies fixed it for Chrome.

This is new, though. I have not changed that setting since I can remember and I don't recall whether it's Chrome's default.

[tobase]

To follow up, Firefox acts the same. The problem goes away when *all* 3rd-party cookies are enabled. It wasn't enough to enable them for visited sites only, or to allow *.ProBoards.com and Twitter.com as exceptions to a limited cookie policy.

Three things about that: (1) A couple of weeks back, 3rd-party cookie settings didn't seem to interfere with Twitter embedding; (2) Twitter embeds still work in Safari, where my cookie preferences setting has always been "Allow from current website only"; and (3) Letting just any 3rd party store a cookie on you is often called a bad, bad idea by people who pay attention to privacy and browser security... ?

[Ulises]

tobase The settings I posted were for Chrome, which has a different setting altogether for disabling/enabling third party cookies which is different from the one I mentioned in my previous post. For twitter, try whitelisting https://platform.twitter.com 

Here are the settings for FireFox for reference:



the exceptions screen:




I tested this and was able to view the embeds again.

[Michael]

It is definitely worth mentioning that we have made zero changes to this area of code in forever. Whatever change took place that started causing issues for people came from another source.

[tobase]

I would have to guess that Twitter changed how it does analytics, but that change doesn't affect everybody quite the same. 


For Firefox, I found it was enough to make the exception recommended by Ulises (thank you very much) except I made the allowance for the session only, not for all time. 

When I did that, I cleaned out all the cookies, closed and restarted Firefox, logged back into the ProBoards forum, and checked to see what cookies were stored now. 

I was surprised to see nothing that had obviously come from Twitter or any other 3rd party. There's more going on here than I understand. This is the whole list of saved cookies at the time: 

[tobase]

For the case of Chrome, this is a picture of what is working from the URL <chrome://settings/content/cookies>:

[tobase]

For anyone trying to understand what's going on with 3rd party cookies and embedded info from Twitter, this is an educated guess.


Twitter won't let you have embedded tweets, unless your browser knows it's OK to exchange info in cookies with Twitter at platform.twitter.com.

— We know that, because as soon as you disallow 3rd party cookie exchanges, the tweets stop appearing.


But Twitter doesn't send your browser a cookie, simply because you asked to display an embedded tweet.

— We know that, because when you look at what cookies you're holding, Twitter embeds work fine without any cookies that came from twitter.com.


That means, Twitter wants to *read* your browser cookies as a 3rd party, before it'll cooperate with your request to see embedded tweets.


– – – – – – – – – –


Different browsers take various approaches to this. If you haven't explicitly allowed 3rd party cookies in your browser settings, then:

• Firefox will not allow cookies to be read or sent by 3rd parties
• Safari allows cookies to be *read* by 3rd parties, but not sent by them
• Chrome… seems to have changed. It used to be like Safari, and now it acts like Firefox.

The Chrome Releases blog announced the rollout of a desktop update on January 4, about the time invisible tweets started happening around here. I don't see where anybody said anything about it, but I wonder if a related change wasn't made to Chrome at that time.