--- url: 'https://metadrop.net/en/articles/embedding-things-using-its-url-and-oembed' title: 'Embedding things using its URL and oEmbed' author: 'Ricardo Sanz' date: '2020-04-21T12:45:24+00:00' updated: '2026-06-09T13:17:21+00:00' type: article summary: 'oEmbed is a format that allows embedding of a properly represented URL. This means rendered in a way that is useful to the visitor. Even clearer: it allows to include things like tweets, video from different providers, Flickr albums and many more without any complication just using an URL. And yes, there is a Drupal module for this.' tags: - 'Drupal Planet' - CKEditor - oEmbed published: true og: determiner: Automatic site_name: Metadrop 'image:alt': 'Embedding things using its URL and oEmbed' street_address: 'Calle Manuel Luna, 12, 3 Dcha' locality: Madrid region: Madrid postal_code: '28020' country_name: España email: hola@metadrop.net phone_number: '910053180' schema: '@context': 'https://schema.org' '@graph': - '@type': Article '@id': 'https://metadrop.net/en/articles/embedding-things-using-its-url-and-oembed#article' name: 'Embedding things using its URL and oEmbed' headline: 'Embedding things using its URL and oEmbed' description: "oEmbed is a format that allows\_embedding of a properly represented URL.\_This means\_rendered in a way that is useful to the visitor. Even clearer: it allows to include things like tweets, video from different providers, Flickr albums and many more without any complication just using an URL. And yes, there is a Drupal module for this." about: - CKEditor - oEmbed datePublished: '2020-06-02T10:15:00+0200' dateModified: '2026-06-09T15:17:21+0200' author: '@type': Person name: 'Ricardo Sanz' publisher: '@type': Organization '@id': 'https://metadrop.net/#organization' mainEntityOfPage: 'https://metadrop.net/en/articles/embedding-things-using-its-url-and-oembed' - '@type': Organization '@id': 'https://metadrop.net/#organization' url: 'https://metadrop.net/' name: Metadrop sameAs: - 'https://www.drupal.org/metadrop' - 'https://twitter.com/metadrop' - 'https://asociaciondrupal.es/partner/metadrop' - 'https://www.linkedin.com/company/metadrop' logo: '@type': ImageObject url: 'https://metadrop.net/themes/custom/mdrop_radix/logo-metadrop-500-500.jpg' width: '500' height: '500' - '@type': ItemPage '@id': 'https://metadrop.net/en/articles/embedding-things-using-its-url-and-oembed' breadcrumb: '@type': BreadcrumbList itemListElement: - '@type': ListItem position: 1 name: Home item: 'https://metadrop.net/en' - '@type': ListItem position: 2 name: 'Expert Drupal & Tech Articles' item: 'https://metadrop.net/en/articles' publisher: '@type': Organization '@id': 'https://metadrop.net/#organization' --- 1. [Articles](https://metadrop.net/en/articles) # Embedding things using its URL and oEmbed Tuesday, June 02, 2020 oEmbed is a format that allows embedding of a properly represented URL. This means rendered in a way that is useful to the visitor. Even clearer: it allows to include things like tweets, video from different providers, Flickr albums and many more without any complication just using an URL. And yes, there is a Drupal module for this. During content creation, it is not uncommon to refer to external content, from simple documents or web pages to multimedia or specific content such as tweets or posts from other platforms. Links are one of the pillars of the web, but sometimes you want something more integrated. If you want to refer to a tweet, why not embed it in our content? A very common case is a Youtube or Vimeo video so that it can be played without leaving the page. Another case can be to visualize a Scribd's PDF file. ## Embedding contents with oEmbed To achieve this there are Drupal modules specific to each case, or generic but focused on one area, such as those that integrate video services. Another strategy is to use something like [oEmbed](https://oembed.com/ "oEmbed home page"). oEmbed is a format that allows you to describe URL representations that can be embedded in other web pages. That is, it is a way by which a provider (YouTube, Twitter, Scribd, Flickr, etc) can describe to a consumer (our Drupal website, for example) how to display a provider's resource. ## URL Embed module Embedding content using oEmbed requires the Drupal site to support this format. But we are lucky since the [Drupal's Media Initiative](https://www.drupal.org/about/strategic-initiatives/media "Media Initiative home page") has created the [URL Embed module](https://www.drupal.org/project/url_embed "URL Embed module's page"). The module integrates oEmbed and allows it to be used in CKEditor fields in a very simple way through a simple dialogue in CKEditor itself. *Embedding a URL in this article on a new autoreference.* The list of supported providers is long, and includes providers of video, documents, photos, and many other things I honestly don't know about. ## Security considerations There's a delicate matter. Through oEmbed, we receive HTML data from external sources that are displayed on our website. Potentially, this can create [Cross-Site Scripting](https://en.wikipedia.org/wiki/Cross-site_scripting "Cross-site Scripting at Wikipedia") problems: if we insert a malicious JavaSript code, it will have access to our domain's cookies, for example. To mitigate this problem [oEmbed suggests displaying the external data on a different domain using an iframe](https://oembed.com/#section3 "oEmbed section 3"). Unfortunately, URL Embed does not have this possibility. Does this mean that this module opens a security hole? Not exactly. The point is that we must trust the provider. For example, it is not probable that a known service as YouTube to return malicious code in its oEmbed response, just like other services such as Vimeo, Flickr and so on (although not impossible, of course). But less well-known services, and therefore less subject to scrutiny, are more likely to return code that is not entirely secure, either intentionally or unintentionally. If we allow oEmbed responses from any provider we'll probably face some security problems in the future. Therefore, it is enough to know the security implications and act with the head, as it usually happens in real life. ## CKEditor 5 Currently, the [url\_embed](https://www.drupal.org/project/url_embed "url_embed") module is not available for CKEditor 5, but there is an open issue[ CKEditor 5 Support](https://www.drupal.org/project/url_embed/issues/3316376 " CKEditor 5 Support") so the examples in this article have been removed until the module is compatible. Drupal Media Core provides oembed , [but only has Vimeo and youtube](https://git.drupalcode.org/project/drupal/-/blob/ef8809482c03af97db01b7aecafdcce9fc9fa302/core/modules/media/src/Plugin/media/Source/OEmbedDeriver.php#L28). There is a contrib module that allows you to choose more providers [https://www.drupal.org/project/oembed\_providers](https://www.drupal.org/project/oembed_providers) Should we keep the URL Embed if the Media Core already provides it? Maybe we should provide a migration from URL embed to Media. ## Conclussion URL Embed is a good module even though it is still alpha. Today it has almost 2,300 installations and in our tests it has not failed. It is true that it is looking for maintainers and that it would love some contribution, but it is good enough to be used, always taking into account the security considerations. [CKEditor](https://metadrop.net/en/articles?text=CKEditor) [oEmbed](https://metadrop.net/en/articles?text=oEmbed) - Ricardo Sanz CTO [Module development and third-party integrations with Drupal](https://metadrop.net/en/services/drupal/integrations " See Module development and third-party integrations with Drupal") Metadrop connects Drupal to your CRM, ERP, payment, and marketing stack — Salesforce, Microsoft Dynamics, BBVA virtual POS, Workday, and Keepeek — with custom modules and secure, GDPR-compliant APIs. See more