If you add a poster attribute to the video element it dosen't load the poster, but works fine in other browsers <video poster="http://camendesign.com/code/video_for_everybody/poster.jpg"> <source src="https://www.w3schools.com/html/mov_bbb.mp4" type="video/mp4"> <p>Your browser does not support the video tag.</p> </video>
I cannot reproduce this with Safari 17 beta. There is something weird going on with the poster size, as it momentarily shows up having the same size as in Chrome, and then becomes smaller.
Created attachment 466857 [details] rendering in safari, firefox, chrome With ``` data:text/html,<video poster="http://camendesign.com/code/video_for_everybody/poster.jpg"><source src="https://www.w3schools.com/html/mov_bbb.mp4" type="video/mp4"><p>Your browser does not support the video tag.</p></video> ``` Safari Technology Preview 173 19616.1.20.2 Firefox Nightly 116.0a1 11623.6.28 Google Chrome Canary 117.0.5859.0 5859.0 The behavior is totally different.
with the data: URL the console says: Refused to load http://camendesign.com/code/video_for_everybody/poster.jpg because it does not appear in the img-src directive of the Content Security Policy. which is interesting because data:text/html,<img src="http://camendesign.com/code/video_for_everybody/poster.jpg"> will work. https://searchfox.org/wubkat/rev/0a80aee13182b2feee32d8519e716edf3e876e18/Source/WebCore/html/HTMLVideoElement.cpp#249-262
Ha this is working. data:text/html,<video poster="https://camendesign.com/code/video_for_everybody/poster.jpg"><source src="https://www.w3schools.com/html/mov_bbb.mp4" type="video/mp4"><p>Your browser does not support the video tag.</p></video> aka https for the poster URL instead of http. So the bug is different. It's more about Content Security Policy for the poster attribute.
To be clear, I was testing with a local file, containing the code from bug description.
I have updated the URL to a codepen illustrating the issue https://codepen.io/benjaminhoegh/pen/NWEjPXE
<rdar://problem/111765501>
after discussions with Anne, it's more about mixed content.
In particular we should be upgrading this request, similar to <img src>.