I got a 403 the first time I visited it, then when I went to the source, and back to the image it works. I suspect they have a cookie or something to detect that you’re a valid user.

Because this is a different domain the cookie would not come with the image request.

Just a wild guess

Actually I found a way to make it work, bit hacky, but you can add #.jpg at the end of your URL. For example, here is your osaka picture as an image post pointing directly to twitter

https://lemmy.world/post/341872

I’ve used

https://pbs.twimg.com/media/Foojf9RaEAA1GM-?format=png&name=small#.jpg

As the URL to force image detection

(if you’re not a dev, I assume this is your face right now, sorry about this:

I’m not a lemmy dev, I just took a look at their repository

I believe it’s the regex that detects if something is an image

A reddit image URL is :

https://i.redd.it/2obhjz2wb37b1.jpg
or
https://preview.redd.it/7s1p7mal707b1.jpg?width=640&crop=smart&auto=webp&v=enabled&s=f741210c6c54fed7c3ed06aaabdb1f0a49fd46cb

in both cases it has “.jpg” (with the dot) in it so it passes the regex. It does not need to finish with it.

Whereas the image your provided does not have that in it.

You can instead download the image and post it like this, or similarly take a screenshot.

I believe that sort of website does this on purpose to make sure they don’t waste server resources on other website that do not drive any ad revenue to them.

I planned on exporting a web version as well and I was testing there first hence the issue.

How would this allow any website to impersonate you though? The login is made via a jwt which would not be accessible if you go in another website. If I login on mysuperlemmyclient.com and then visit maliciouswebsite.com, how can maliciouswebsite access the jwt that is stored likely in a cookie of mysuperlemmyclient.com?