Untrusted URLs in VRChat
Adlily primarily utilizes Untrusted URLs to deliver aggregate analytics and serve ads. Although our capabilities are reduced without Untrusted URLs, we can still offer our essential core functionality, which is to serve content.
Untrusted URLs allow worlds to load content from arbituary external sources. This is a powerful feature that allows worlds to load images, videos (opens in a new tab), and other content from the internet. However, this also opens up the potential for malicious actors to load content from malicious sources. VRChat has implemented a security model that allows users to opt-in to loading content from external sources, which is called Untrusted URLs.
How do I enable Untrusted URLs?
Untrusted URLs are disabled by default. Adlily and many worlds may not work with Untrusted URLs disabled, but there are potential security risks with having Untrusted URLs enabled, so it is important to understand the risks before enabling it.
Open Settings Quick Menu
Open your VRChat Quick Menu and click on the Gear Icon on the bottom right.
Expand Settings Menu
After opening your Quick Menu Settings View, click the Fullscreen Icon in the top right. This will expand the settings menu to show all available options, including the Comfort & Safety tab.
Comfort & Safety Tab
Once you've opened your settings view, click on the Comfort & Safety tab on the left sidebar. This will show all of the available options for comfort and safety settings.
Enable Untrusted URLs
And finally, click the Allow Untrusted URLs toggle so that it says On. This will allow worlds to load content from external sources. Learn more about the implications of enabling Untrusted URLs in the section below.
You will need to rejoin the world for this change to take effect.
Technical Details
The following section highlights some of the technical details of Untrusted URLs. This information is not necessary to use Adlily, but may be useful to understand how it works.
Limitations
At present, we display ads exclusively to users who have not enabled Untrusted URLs, adhering to our principle of exclusively offering advertising that provide compensation. Internally, we leverage the data gathered from users with Untrusted URLs to infer the behavior of those without it. Soon, we plan to establish a mechanism that utilizes this data to pay publishers for advertisements viewed by users without Untrusted URLs.
To see more information about this limitation, and others like it, see VRChat's documentation on Image (opens in a new tab) and String Loading (opens in a new tab). These limitations are not specific to Adlily, but are inherent to VRChat's security model.