{"action":"closed","issue":{"url":"https://api.github.com/repos/humanmade/protected-embeds/issues/3","repository_url":"https://api.github.com/repos/humanmade/protected-embeds","labels_url":"https://api.github.com/repos/humanmade/protected-embeds/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/humanmade/protected-embeds/issues/3/comments","events_url":"https://api.github.com/repos/humanmade/protected-embeds/issues/3/events","html_url":"https://github.com/humanmade/protected-embeds/issues/3","id":138249581,"number":3,"title":"Protected embed iframes should be requested from PROTECTED_EMBEDS_DOMAIN","user":{"login":"goldenapples","id":665992,"avatar_url":"https://avatars.githubusercontent.com/u/665992?v=3","gravatar_id":"","url":"https://api.github.com/users/goldenapples","html_url":"https://github.com/goldenapples","followers_url":"https://api.github.com/users/goldenapples/followers","following_url":"https://api.github.com/users/goldenapples/following{/other_user}","gists_url":"https://api.github.com/users/goldenapples/gists{/gist_id}","starred_url":"https://api.github.com/users/goldenapples/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/goldenapples/subscriptions","organizations_url":"https://api.github.com/users/goldenapples/orgs","repos_url":"https://api.github.com/users/goldenapples/repos","events_url":"https://api.github.com/users/goldenapples/events{/privacy}","received_events_url":"https://api.github.com/users/goldenapples/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-03T17:47:48Z","updated_at":"2016-03-04T18:37:49Z","closed_at":"2016-03-04T18:37:49Z","body":"Currently the iframe serving a protected embed is served from `site_url( '/protected-iframe/' . $embed->get_id() )`. This seems wrong, as the point of this plugin is to be sure to serve these iframes from a separate domain from the site.\r\n\r\nThis also causes the postmessages being used to resize the iframes to fail, because the target origin specified in the postMessage call doesn't match the actual document origin of the iframe. As a result, frames are not resizing correctly and are cut off at 150px height.\r\n\r\nThe offending line seems to be here:\r\nhttps://github.com/humanmade/protected-embeds/blob/master/protected-embeds.php#L77 "}}