Over the last few days, I received several messages from Connections users reporting that their embedded YouTube videos could no longer load in Connections Blogs and instead displayed Error 153. This prompted me to investigate the issue.
Update 2025-12-12 #
I got an update from HCL support:
Our engineering team provided the following feedback and recommendation
Please refer to the document below for more details: \
https://help.hcl-software.com/connections/latest/admin/admin/t_change_blogs_referrer_policy.html?h=referrer
Please add the following generic property: to change the Blogs referrer policy,
<genericProperty name="blogs.noreferer.policy">false</genericProperty>
I have no clue why I couldn’t find this part of the documentation before. Be aware of the typo, the genericProperty and the function (isNoRefererPolicy()) in themes use referer with just 3 instead of 4 r.
Reproducing the Problem #
The issue was easy to reproduce. I copied embedded video code directly from YouTube:
<iframe width="560" height="315"
src="https://www.youtube.com/embed/atPvnJMGdfs?si=amKXQfsUL2h0KHvy"
title="YouTube video player" frameborder="0"
allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share"
allowfullscreen></iframe>When I added this to the HTML source of a Wiki page or Forums entry, the video player loaded correctly and displayed a preview. However, adding the same code to Blogs produced Error 153.
I created a community on the HCL Preview server to demonstrate the issue:
- Wiki Page - Video loads successfully
- Forums Entry - Video loads successfully
- Blog Post - Error 153 displayed
So it’s not a generic issue and I suspected the active content filter, but then I found that the blog post loads in the tiny editor and the draft view of blogs.
Narrowing Down the Cause #
This suggested it wasn’t a generic issue. I initially suspected the active content filter, but then discovered that the video loads correctly in the TinyMCE editor and in the drafts view of Blogs.
Since the embedded iframe code was saved without modification, this ruled out the active content filter. A quick Google search revealed several forum posts and blog articles describing Error 153. I tested workarounds such as adding referrerpolicy="strict-origin-when-cross-origin" to the iframe tag. This worked well with CKEditor, but since TinyMCE is the only supported editor as of 8.0CR10, I tested with the latest version. Unfortunately, TinyMCE removes the referrerpolicy attribute from iframes when saving.
This pointed to the referrerpolicy setting. The <head> section in Blogs contains:
<meta name="Referrer" content="no-referrer">All other pages and apps do not include this meta tag.
Attempting to Override via HTTP Header #
Normally, you can override this with an HTTP header:
<LocationMatch "^/blogs">
Header set Referrer-Policy "origin"
</LocationMatch>The possible values for Referrer-Policy are:
no-referrer- Never send referrer information (most restrictive)no-referrer-when-downgrade- Send referrer only when protocol stays the same or upgrades (HTTPS→HTTPS or HTTP→HTTPS, but not HTTPS→HTTP)same-origin- Send referrer only for same-origin requestsorigin- Always send just the origin (scheme + hostname + port), never the full URLorigin-when-cross-origin- Send full URL for same-origin, origin-only for cross-origin (good privacy balance)strict-origin- Send origin-only, but only on same-protocol requests (no downgrade to HTTP)strict-origin-when-cross-origin- Send full URL for same-origin on same protocol, origin-only for cross-origin on same protocolunsafe-url- Always send full URL with path (least restrictive, most privacy-invasive)
From my analysis, origin-when-cross-origin should work for Blogs since the other apps already send the Referrer URL, making it safe to send the hostname. However, I tried all these options and couldn’t override the meta tag in Blogs’ header—the video still wouldn’t display.
Finding the Root Cause #
The next step was to search for the meta tag in Blogs.ear. I found it was set within the theme files:
blogs.war/themes/Blog_with_Multiple_Authors/_header.vm
...
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xml:lang="$utils.replace($utils.request.getAttribute('langPara'),"_","-")" lang="$utils.replace($utils.request.getAttribute('langPara'),"_","-")" #if($utils.isRTL())dir="rtl"#end>
<head>
$utils.getReactUIMarkup()
#if($utils.isNoRefererPolicy())
<meta name="Referrer" content="no-referrer">
#else
<meta name="Referrer" content="origin">
#end
<title>
...I searched for the function or variable that defines isNoRefererPolicy but couldn’t locate it. My solution was to modify the file:
...
<!DOCTYPE html
PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xml:lang="$utils.replace($utils.request.getAttribute('langPara'),"_","-")" lang="$utils.replace($utils.request.getAttribute('langPara'),"_","-")" #if($utils.isRTL())dir="rtl"#end>
<head>
$utils.getReactUIMarkup()
#if($utils.isNoRefererPolicy())
<meta name="Referrer" content="origin-when-cross-origin">
#else
<meta name="Referrer" content="origin">
#end
<title>
...After restarting the Blogs application in WebSphere, the video loaded successfully in Blogs as well. Issue resolved.
Summary #
Online, I found several suggestions about clearing cookies and other workarounds, but the root cause was the referrer policy, which is disabled in Blogs by default. By changing the meta tag from no-referrer to origin-when-cross-origin, YouTube received the necessary referrer information to load the embedded video.
Note: This solution requires access to the Blogs.ear file and WebSphere administration, which may not be practical for all users. Consider contacting HCL support for a permanent fix in future releases.
