TL;DR
If you are embedding the legacy Twitch chat URL (www.twitch.tv/<channel>/chat
) in an iframe, this embed will not be functional after March 31.
Please update your embeds to the new URL: www.twitch.tv/embed/<channel>/chat
Why are we doing this?
The legacy Twitch chat is built on a separate codebase that is no longer being maintained.
How is the user impacted?
The new embed URL will introduce two changes:
- The settings cog will be disabled.
- The first time a user attempts to send a message, a popup will warn the user that they are sending a message to a Twitch chat channel. This setting is saved until the user refreshes the page.
Both of these changes are required to address existing security concerns.
NOTE: When not embedded (such as clicking through a bookmark), the legacy URL will redirect to the full popout chat experience without these restrictions.
â UPDATE: 2018/04/06 â
tl;dr â Weâre pushing back the legacy chat embed EOL to 4/20 to coincide with the EOL of legacy chat in its entirety. Embeds will continue to function until this time. On 4/20, legacy chat will no longer be available (as an embed, or otherwise). I know this is a tight timeframe for some folks, so please feel free to reach out if you need any assistance or additional clarification.
Also, just to reiterate; the primary motivation for this move is to protect the safety and security of our community. The legacy chat embeds are susceptible to attacks known as âclickjackingâ. This is not a risk we feel is acceptable, and it is for this reason that we must continue with the EOL process.
There are currently no plans to reimplement the features which have been removed. We have been working closely with our security teams to ensure that we are only implementing features which donât pose a security risk.
Some additional context for the curious:
Originally we wanted to have the Twilight (new) version of the embed out and deprecate the Ember (old) Popout in August when Twitch Everywhere launched. This was pushed back because people who used the popular extensions BetterTTV and FFZ were upset that their new extensions wouldnât work in Twilight and thus needed the Ember Popout. Due to that, we left the Ember popout live for those users. A side effect of that was that the Ember Popout route still operated and was still able to be embedded. This was a known security risk, but one that we were okay with given the timeline to deprecate shortly in the future.