title attribute still not added to oEmbed iframe

tl:dr; Unlisted or domain-restricted Vimeo videos do not return metadata (including the title) in the oembed API results unless the URL is sent as a Referer header.

I've noticed the title attribute missing from the inner iframe when using the oembed content in Drupal to display videos.

From what I can tell, the core media module is getting the iframe code directly from the Vimeo API response using their oembed.json. The request is made in core/modules/media/src/OEmbed/ResourceFetcher.php. A request to the Vimeo API looks like this: https://vimeo.com/api/oembed.json?url=https%3A//vimeo.com/VIMEO_VIDEO_ID

In reviewing the Vimeo API documentation for oembed's, this appears to be an issue with the video privacy settings. The videos on our sites have domain-level privacy enabled on Vimeo -- this means the videos can only be embedded and viewed on the configured domains. In the "Embedding videos with domain-level privacy" section, it says (paraphrasing):

For videos with the whitelist privacy setting — that is, videos with domain-level privacy — The oEmbed request returns a simplified response containing no private metadata.

The metadata excluded includes the "title" attribute.

The solution according to the documentation is to send the URL as the Referer header in with the request (and a curl example is given).

curl -e http://example.com https://vimeo.com/api/oembed.json?url=https:%2F%2Fvimeo.com%2F286898202

I'm not exactly sure how to build this into the `ResourceFetcher`, but that seems to be the solution for this (if possible).

I was able to test sending the request a Referer header and it worked successfully.

In core/modules/media/src/OEmbed/ResourceFetcher.php starting on line 69:

      $response = $this->httpClient->request('GET', $url, [
        RequestOptions::TIMEOUT => 5,
        'headers' => [
          'Referer' => 'https://MYURL.COM',
        ]
      ]);

I then checked the response with and without the header. With the header it returned the title (and a number of other metadata). It also include the title attribute on the iframe. Without the header it was missing the metadata and had no title attribute on the iframe.

I will see if I can't work on actual patch/MR with the actual site URL instead of it hard-coded, but I wanted to test the path forward first. This might fit into its own issue at this point because of the specific scenario?

#68 seems to outline another instance where treating all oembed providers equally simply doesn't work in practice.

In my mind this adds a lot more weight to the issues floating around that support altering various inputs and outputs of the oembed media system.

joegl, feel free to open an issue with https://www.drupal.org/project/oembed_lazyload → and we may be able to make this accessibility enhancement available with no code and/or patches for end-users faster than core is able to adapt to the need. 👍