Is it possible to use open graph image rom another host?

Viewed 3449

I've been searching high and low for an answer for my question. With no luck.

If I run a website on https://www.x.com, can my og:image be from https://www.y.com?

<meta property="og:image" content="https://www.y.com/images/thumb.jpg" />
2 Answers

Yes, all og meta tags can showcase a different domain, even the url, as was purportedly discovered by Barak Tawily last month. The og meta tags are meant to indicate what content is available on a website, though there is no way to know what is actually there until a user clicks on the links. Note that while this can be used legitimately, it can also be used to for nefarious purposes.

According to TheHackerNews:

Interestingly, Tawily found that Facebook does not validate if the link mentioned in 'og:url' meta tag is same as the page URL, allowing spammers to spread malicious web pages on Facebook with spoofed URLs by just adding legitimate URLs in 'og:url' Open Graph meta tag on their websites.

Tawily's video showcases spoofing og:image at the same time as spoofing other og tags:

Spoof

All you need to do is set the content attribute to the secondary domain.

Hope this helps! :)

Yes, it can be.

An example from the documentation from fb:

<html prefix="og: http://ogp.me/ns#">
<head>
<title>The Rock (1996)</title>
<meta property="og:title" content="The Rock" />
<meta property="og:type" content="video.movie" />
<meta property="og:url" content="http://www.imdb.com/title/tt0117500/" />
<meta property="og:image" content="http://ia.media-imdb.com/images/rock.jpg" />
...
</head>
...
</html>

The content can be whatever you want it to be.

Reference: http://ogp.me/

Related