iamcal/oembed — Issue #13: API endpoint vs. HTTPS
Author: brendanjerwin
Created: 2012-01-18 14:54:43+00:00
State: open

The spec explicitly states that the API endpoint must be on HTTP. However, when embedding content on a site hosted on HTTPS the requests can cause browsers to complain of mixed security content.

Additionally, when a call to the API endpoint is made via HTTPS, the provider should assume that the requester wants the embedded content to be retrieved via HTTPS as well.

Vimeo already appears to behave this way.