标签：#webdev

<form action= "https://bank.com/transfer" method= "POST" > <input name= "to" value= "attacker" > <input name= "amount" value= "10000" > </form> <script> document . forms [ 0 ]. submit () </script> Five lines of HTML on a malicious page. When a user who's logged into bank.com in another tab visits this page, the browser auto-submits the form, attaches their session cookie, and ten thousand dollars leave their account. They didn't click anything. The malicious site didn't see their password. There was no XSS, no breach, no leak in the traditional sense. The browser did exactly what it was designed to do. That's CSRF — Cross-Site Request Forgery — and it's been the classic "confused deputy" attack on the web for two decades. Let's walk through what makes it work, why CORS doesn't help, and the one cookie flag that mostly killed it around 2020. Why the browser attaches your cookie to that request Cookies belong to a domain. When you log into bank.com , the bank sets a session cookie in your browser: Set-Cookie: session=abc123; HttpOnly From that point on, every single request your browser sends to bank.com carries that cookie. Every page load. Every API call. Every image fetch. The browser does it automatically, without asking, and regardless of who triggered the request. That last word is the door CSRF walks through. The browser attaches the cookie based on where the request is going , not where it came from . So when evil.com triggers a POST to bank.com/transfer , the browser sees a request destined for bank.com , looks up the cookies for bank.com , and attaches them. As far as the bank's server can tell, the request looks exactly like one the user submitted from inside the bank's own page. This is the "confused deputy" idea. Your browser is the deputy. It has authority on your behalf (your cookies). And it's been tricked into using that authority for someone else's benefit. The server has no way to tell the difference, because from its point of view, there isn't one.

Live app: https://layoffs.kadoa.com Data and code are open source: https://github.com/kadoa-org/layoffs-tracker The federal WARN Act requires employers with 100+ workers to give 60 days notice before mass layoffs or plant closings (different thresholds by state, but roughly 50+ jobs lost). But the notices are scattered across 50 state websites, each with its own format, broken links, and no API. I think this should be transparent and easy-to-access public data, so I built an open-source aggregator for it. submitted by /u/madredditscientist [link] [留言]

submitted by /u/rebane2001 [link] [留言]

What will happen if i failed to pay my imagekit bill? i used imagekit server initaly bill is 9 dollar but after 2 week my invoice is 120 dollar , if i didnot able to pay they will terminate my account or take legal action? submitted by /u/Few_Construction7431 [link] [留言]

I started with project level .codex and .claude folders to keep the skills. Most of the skills are common for both of the models and when I change something in them now I need to update the other one as well. It has become an additional maintenance job. I created a root level skills folder and tried to make them share the same skills but; they sometimes create files that they like to use like codex adds openai.yaml things; they still go .codex or .claude folders sometimes even though I told them to look in the skills folder etc. etc. I would like to know how do you deal with these kind of things? submitted by /u/abstracten [link] [留言]

I've been putting off getting deeper into web design for a long time. Not because I wasn't interested, but because I kept telling myself I'd do it properly "at some point". At some point eventually arrived, and this is what came out of it. The motivation was simple: I couldn't find a task manager that just lived in my browser tab without requiring an account, an extension, a subscription, or a whole app install. I wanted something minimal, fast, and always there. So I built it myself. What it is: Vanta is a single HTML file Open it in your browser, bookmark it, done. It has: - Three themes (Focus, Minimal, Paper) - Drag-and-drop reordering - Separators to group tasks visually - Named profiles to save and switch between different lists - Full undo/redo (Ctrl+Z / Ctrl+Y) - JSON import/export - Keyboard shortcuts throughout - Everything persisted in localStorage I deliberately kept it as one file. I didn't really see a reason to split it - it's not a framework project, it's a tool I open in a tab. That was a conscious choice, though I'm curious if others would have approached that differently. https://github.com/Ventexx/vanta-Checklist What I'm actually after: Functionally, I'm happy with it. It does what I needed it to do. What I'm less confident about is everything else. I have always had a complicated relationship with web design. I've made projects that touched on it, but I've never built something I was genuinely visually pleased with at the end. Vanta comes closer than anything I've done before, but I still feel like I'm missing something beyond this - if I want to keep going down the path of building things that are actually aesthetically considered, I don't think I'm quite there yet in how I approach it, and I'm not sure where to look next. So if you have thoughts on where to go from here - what to learn, what I've approached wrong, or just what you'd improve in the app itself - I'd genuinely appreciate hearing it. This is the kind of thing I usually don't have

Hi r/webdev ! I have a bit of a unique backstory for this Showoff Saturday. Back in 1992 , while working as a math teacher, I wrote the very first version of a mental math training program named Aritm in C. Fast forward to today, and I have completely modernized it into Aritm SR —a mobile-first web app, now featuring full English support and optional speech recognition. The Tech & Features: Why I built it: While great platforms like Khan Academy exist, they often rely purely on randomly generated questions. Based on my experience teaching math, Aritm acts more like a physical deck of flashcards that gets shuffled, creating a much better learning rhythm for memorization. I would love to get the community's feedback on the frontend structure, how the speech recognition feels, or any tips on optimizing mobile web performance!Thanks for checking it out, and I'm happy to answer any questions about its 30+ year evolution! submitted by /u/mobluse [link] [留言]

Hey , I got tired of waiting 60 seconds for traditional cloud servers to spin up, and standard Docker containers sharing a single kernel felt like a security risk for multi-tenant apps. So, I built Krova (krova.cloud).It lets you spin up ultra-lightweight, completely isolated micro-VMs (we call them "Cubes") running directly on dedicated bare-metal hardware. Key Features: Sub-second boot times: Container speeds, but with true hardware-level VM isolation. Sleep & Wake: You can pause a Cube to stop compute billing entirely. You only pay a tiny passive storage fee while it sleeps, and it wakes back up in milliseconds exactly where you left off. Reliable Hardware: Everything sits on enterprise servers with ECC RAM (no bit flips) and Mirrored NVMe SSDs (RAID 1). It's fully integrated with Cloudflare for automated HTTPS certificates out of the box. I’m looking for developers, engineers, and hobbyists to stress-test the platform. What features are missing that would make you switch your staging or production workloads over? submitted by /u/logical_people [link] [留言]

Hi there! I am a web dev with over 7 years of industry experience. Renovo is an expiration and document tracker for businesses and the self employed. Think restaurant owners, general contractors, etc. The target audience is users with licensing/permits to keep track of for their business(es). The free tier allows a user to get a lot out of the app. The paid version allows the user to store their actual PDF documents with the record and some extra goodies. Bigger businesses typically have enterprise software with compliance tracking baked in, often as a side thought. Alternatives tend to cost twice as much and more. Would love to hear anyone's feedback as I recently launched and only have a couple users so far. This post and any comments I make here are written by me, a human 🙂 submitted by /u/OutOfTuneAgain [link] [留言]

Hey everyone. I have created a fully free PDF editor that doesn't require accounts. The files stay on your device, they are not uploaded anywhere. I have tried to add as many features as I could think. I hope someone will find it useful. Let me know what you think about it! The website is http://katanapdf.com submitted by /u/Standard_Ad_6045 [link] [留言]

Been working a lot on this on the side for a few months, it's stable enough now that I wanted to put it in front of people who actually run OpenTelemetry. So it reads the OTel traces your services already emit and flags I/O anti-patterns: N+1 SQL and HTTP, redundant calls, slow queries, excessive fanout, chatty services between services and pool saturation. It works at the protocol/span level, so it doesn't need to know whether you're on Hibernate, EF Core, SQLAlchemy or a bare driver, it just sees the queries they end up sending. Two ways to run it: as a one-shot CI gate on captured traces (exits non-zero past a threshold, emits SARIF so findings land in GitHub/GitLab code scanning), or as a long-running daemon that ingests OTLP and exposes Prometheus metrics, a query API and a self-contained HTML dashboard. Single static binary, no agent to attach to your runtime. It idles around 17 MB and in daemon mode it sustains roughly 1M events/sec at ~190 MB (peaks around 1.8M on the pipeline, benchmarked it on an M4 Pro in Docker). The piece I put the most care into is the energy/carbon scoring partly because while I'm a developer, I came with a personal background in environmental science and didn't want to just slap a green badge on it. Each finding gets an I/O intensity and waste ratio score, and it estimates CO2 per request with the SCI v1.0 / ISO 21031 formula. The default model is directional and I say so plainly: it ships a 2x uncertainty bracket and isn't a wattmeter replacement, so you can wire in measured energy ( Scaphandre RAPL , Kepler eBPF or Redfish ) and live grid intensity from Electricity Maps to tighten it. The methodology doc lists the actual sources instead of waving hands. To be clear about what it isn't: not a full APM, not a profiler, not (yet) an "official" regulatory carbon accounting tool (kinda already in a process with INR these days). If you want a full SaaS experience, Datadog or Sentry already do that. This is the narrow, lightweight bit the

Finally got around making an portfolio site how is it ? (dev) submitted by /u/Miserable_Advice1986 [link] [留言]

I’ve added an Easter egg to my portfolio. I wanted to run "Bad Apple" I started experimenting with ASCII art, but then I remembered that you can also print pic in console in the latest versions of Chrome that bad apple didn’t exist before, so I went ahead and did it: NPM : https://www.npmjs.com/package/bad-apple-console Github : https://github.com/alienpingu/bad-apple-console full video : https://www.youtube.com/watch?v=lDpTDnPwZhk let me know if it is usable, thanks! submitted by /u/alienpingu [link] [留言]

I’ve added an Easter egg to my portfolio. I wanted to run "Bad Apple" I started experimenting with ASCII art, but then I remembered that you can also print pic in console in the latest versions of Chrome that bad apple didn’t exist before, so I went ahead and did it: NPM: https://www.npmjs.com/package/bad-apple-console Github: https://github.com/alienpingu/bad-apple-console full video: https://www.youtube.com/watch?v=lDpTDnPwZhk let me know if it is usable, thanks! submitted by /u/alienpingu [link] [留言]

Just to showoff one little project of my own. I've been building a lots of SaaS (5k euros mrr currently) and I finally wrote the whole recipe in a tool. Write your idea in plain language, it will evaluate who your competitors could and if your project could generate money. With that it will build a full roadmap over 30 days, from the landing page, to the marketing and billing. https://letmecookit.app Happy to get your feedback! submitted by /u/InnerPhilosophy4897 [link] [留言]

22 Astro Best Practices: The Bookmark-Worthy Tips At QuotyAI I'm using Astro to build landing pages and blog posts, so I have hands-on experience how to use it properly and how to vibe-code without headache. Astro is the best framework for content sites right now - #1 in developer satisfaction in the State of JS 2025 survey, with Cloudflare backing it since January 2026. But like any tool, it rewards people who use it the way it was designed. This is the reference I wish I had when I started. Whether you're building your first Astro project or vibe-coding a blog at 2am, these are the habits worth forming from day one. Heads up on versions: This article covers Astro 6.x (released March 2026) and Astro 6.4 (released May 2026). Some APIs from older tutorials are now deprecated - those are called out explicitly below. Always check the upgrade guide when moving between majors. 🖼️ Assets & Media 1. Use <Image /> instead of <img /> Astro's built-in <Image /> component does a lot of work at build time that plain <img> tags leave on the table: it converts images to WebP, generates the right width and height attributes to prevent layout shift, and compresses everything without you touching a single config file. --- import { Image } from 'astro:assets'; import hero from '../assets/hero.png'; --- <!-- ✅ Optimized: converted to WebP, compressed, no layout shift --> <Image src={hero} alt="Hero image" /> <!-- ❌ Skips all of that --> <img src="/hero.png" alt="Hero image" /> For art-direction scenarios (different images at different breakpoints), reach for <Picture /> instead. 2. Use the Astro 6 Built-in Fonts API Almost every website uses custom fonts, but getting them right is surprisingly complicated - performance tradeoffs, privacy concerns, self-hosting, fallback generation, and preload hints. Astro 6 added a built-in Fonts API that handles all of it for you. Configure your fonts in astro.config.mjs : // astro.config.mjs import { defineConfig , fontProviders } from ' astro/conf

The Problem We Were Actually Solving We were not building a demo. We needed to let Veltrix operators run A/B experiments on synthetic user journeys without melting the underlying SQL warehouse. The real question was: how close could we push the warehouse to the AI inference layer before the planner started dropping predicates and the warehouse returned rows that made no sense for the user journey. The warehouse in question was a Snowflake XL on AWS, billed by the second. Our synthetic user model generated 250 k journeys per minute during peak. The AI layer had to annotate each journey with intent tags (shopping, support, fraud) within 200 ms to stay ahead of the next batch. That was the operating envelope, not the sales slide. What We Tried First (And Why It Failed) First cut: put the intent model in a sidecar container next to the Spark cluster that generated the journeys. We picked ONNX Runtime v1.14 with a DistilBERT fine-tuned on our own corpus because the latency slide said 30 ms. Reality: ONNX packaged the tokenizer as a separate DLL. Tokenization alone took 85–110 ms on c6i.large instances, pushing the total inference time to 190 ms when the warehouse was cold and 280 ms when Snowflake decided to spike the warehouse cluster. The operator dashboards immediately showed orange pings; the business called it a red fire drill. Worse, the tokenizer DLL leaked memory. After two hours on a 64-core cluster, each pods RSS climbed to 2.4 GB, and the Kubernetes scheduler evicted five pods in a row. The warehouse downstream received duplicate rows with NULL intents, so every metric we exported was off by 7–12 %. The Architecture Decision We ripped out the sidecar entirely. Instead, the Spark jobs write raw event JSON to an S3 bucket every 60 seconds. A Lambda function (Python 3.12 runtime) picks up the bucket, tokenizes offline, and stores the tokenized blobs back in S3. A nightly Kubernetes job then loads the tokenized chunks into Snowflake as temporary tables. The AI inf

GitHub: github.com/vivek1504/forge Live Demo: forge.vivekjadhav.xyz i built this project that runs full IDE entirely client-side. I've attached a quick demo video showing it in action. It uses WebContainers under the hood. You can pick a framework (React, Vue, Svelte, or plain Node), write code in a Monaco editor, and get a live preview with HMR. It includes a functional file explorer and a real integrated terminal without spinning up any cloud VMs or Docker containers. submitted by /u/viks98 [link] [留言]

You enter a domain and it runs a full security stack analysis in one shot: Redirect chain - traces every hop from HTTP to HTTPS, flags mixed content and redirect loops SSL certificate - expiry date, issuer, SANs, grade (A–F), protocol versions (TLS 1.0/1.1/1.2/1.3) Security headers - HSTS, CSP, X-Frame-Options, Permissions-Policy, Referrer-Policy, and more, each rated HTTP/2 & HTTP/3 - detects ALPN negotiation and confirms QUIC via actual UDP connection DNSSEC & CAA - checks if the zone is signed and if CAA records restrict which CAs can issue certs HSTS preload status - tells you if you're on Chrome's preload list (or why you're not) Mixed content scanner - crawls the page and flags any HTTP resources loaded over HTTPS Beyond the one-off check there's also: Bulk check - up to 10 domains at once Cert expiry reminders - email alert before your cert expires Domain monitoring - periodic re-checks with email diff when something changes No account required. API available for automation. Do you find this useful? Looking for feedback. submitted by /u/EveningRegion3373 [link] [留言]

A few weeks ago, I was updating some marketing assets for one of my projects. Everything looked good until I noticed a small problem. The image contained an old QR code. The QR code was pointing to an outdated page, and I needed to remove it before publishing the image again. My first thought was, "This should be easy." I opened a few image editing tools and quickly realized it wasn't as simple as I expected. Most solutions required installing software, learning editing techniques, or manually covering the QR code with another object. Some AI tools could do it, but they were either paid or required creating an account. For a task that should take a few seconds, I was spending far too much time. That's when I started wondering: "Why isn't there a simple tool that only removes QR codes?" The Problem With QR Codes QR codes are everywhere. They're on flyers, product images, posters, presentations, screenshots, and social media graphics. The problem is that QR codes don't always stay relevant. Businesses change landing pages. Campaigns expire. Links break. Sometimes you simply want to reuse an image without the QR code. Yet removing one often requires using software designed for professional designers. Building a Simpler Solution Instead of continuing to search for a solution, I decided to build one. The goal was simple: Upload an image Detect QR codes automatically Remove them Download the cleaned result No accounts. No complicated editing. No learning curve. Just a tool that solves one problem well. After several iterations, the result became the Remove QR Code tool on ConvertKR. What I Learned One thing I've learned from building developer tools is that users don't always need more features. Sometimes they just need fewer steps. The best tools are often the ones that remove friction from a small but frustrating task. Removing a QR code is not something people do every day. But when they need it, they want the process to be fast. Try It Yourself If you've ever found yo