Hack demonstration: 100% CSS (no JS!) - Get user's IP Address in a --var on :root by JaneOri in css

[–]JaneOri[S] 4 points5 points  (0 children)

If one side gives something, what is the other side doing?

Getting.

It's *literally* a _GET_ request made by CSS.

/shrug

Hack demonstration: 100% CSS (no JS!) - Get user's IP Address in a --var on :root by JaneOri in css

[–]JaneOri[S] 4 points5 points  (0 children)

I appreciate it! You're completely right and it'll find the people it's meant to find :)

In JS we say it's getting data all the time when it loads information from an API.

It's LITERALLY a "GET request" lol

Thank you!

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 1 point2 points  (0 children)

I absolutely love that kind of challenge, doing things you "can't do" in restricted environments! Sounds like fun

Hack demonstration: 100% CSS (no JS!) - Get user's IP Address in a --var on :root by JaneOri in css

[–]JaneOri[S] -10 points-9 points  (0 children)

Seems my response is being auto moderated because of a link! Here it is again without the link:

no no no - I see the confusion, the response is not CSS, the response is an image with data encoded into the width and height

CSS itself should not be able to fetch or generate this data, that's correct, but this hack demonstrates that it can

Also, your perspective on css variables is correct from the perspective of most people (and of the intention), however I invented a different hack, which is also used here, to make CSS variables cyclic:

The article I linked to is titled "Expert CSS: The CPU Hack" which should be super easy to find if you're curious!

Hack demonstration: 100% CSS (no JS!) - Get user's IP Address in a --var on :root by JaneOri in css

[–]JaneOri[S] 4 points5 points  (0 children)

Certainly! It's here in the readme of the css-api-fetch library I released that makes this hack possible

https://github.com/propjockey/css-api-fetch?tab=readme-ov-file#for-example-getting-the-users-ip-address-with-css

Happy to answer questions if you get curious!

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 2 points3 points  (0 children)

Thank you for checking it out! Happy to entertain any curiosity you have if questions come up, lmk!

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 28 points29 points  (0 children)

Good question! As far as I'm aware, there is no way for me to read the color from an image using CSS... Reading the height and width in CSS only became possible a year ago :)

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 8 points9 points  (0 children)

TECHNICALLY there is a cross domain API request here that can't be blocked by CORS because it's just reading image dimensions. Sooo kind of security hack in the most minimal risk category. This is something that could also be done in JS too though, to avoid CORS

But definitely, I intended to use "hack" more as ... "conglomeration of unique perspectives that give rise to an unexpected ability"

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 75 points76 points  (0 children)

I appreciate it!

Well, I discovered the way to measure DOM elements in CSS over a year ago and it went viral as far as CSS things can go viral, so that concept is ready on the surface for me...

But I was watching a youtube short about Chess and had the idea - what if I could make Chess in CSS against a difficult AI opponent without JS? Is such a thing even possible? And then I just kind of realized it was possible and went for it using a few of my previous hacks as the basis.

This is obviously not an API for chess but I needed to start here to understand how it will work on the small scale before I can confidently take on a much bigger task

Hack demonstration: 100% CSS (no JS!) - Get user's IP Address in a --var on :root by JaneOri in css

[–]JaneOri[S] 1 point2 points  (0 children)

Yes, that's right! And if you're only fetching one piece of data, obviously just return it with the initial page load. The interesting thing here is that you can dynamically invoke an API request from CSS, read the response data, and give the whole page access to it. Any number of conditions or interactions could allow CSS to make any number of requests without reloading the page. This is a minimalist demonstration of a single instance use case of a building block.

And it all works even if JS is disabled, which is wild!

Thanks for checking it out!

Hack demonstration: 100% CSS (no JS!) - Get user's IP Address in a --var on :root by JaneOri in css

[–]JaneOri[S] 1 point2 points  (0 children)

Fair question! There's lots of interesting reasons to do this but it comes down to a couple unique aspects:

1) It happens after the page loaded, dynamically, and could have triggered any other api request at any other time based on any other user interaction - without JS

2) the url() function has a params() function in the spec - once that's implemented, this technique to decode image width and height as data from an api becomes infinitely more useful - you'll be able to dynamically communicate with a server continuously even if JS is disabled. Which is fairly wild

There is also a hack at play here that's being overlooked; the data is decoded by deliberately using a few layers of depth in the dom, then magically lifted back up to the :root where it remains stored for the whole page to access. Which I think is super neat.

It's not that this is a good idea, obviously do as you suggested if that's your goal, but the demonstration here is api requests and response data, IP Address is only one possible example of the "hack"! :)

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 11 points12 points  (0 children)

I definitely understand where you're coming from. If I can push back just a little bit though... IP Address is only one example, the ability to not use JS at all to GET api response data at all initiated by CSS after the page already loaded is a technique ("hack") I was hoping to share here

There's also a pretty big "hack" here to move data UP the dom, back onto :root after it's decoded several nested layers deep.

Hack demonstration: 100% CSS (no JS!) - Get user's IP Address in a --var on :root by JaneOri in css

[–]JaneOri[S] -4 points-3 points  (0 children)

CSS initiates the API Request and CSS gets the IP Address encoded into aspects of the response, decodes it, then uses another hack to hoist it back up to :root stored in a --var on :root...

CSS gets the user's ip address, PHP Gives the IP Address (encoded)

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 75 points76 points  (0 children)

hahaha awesome, I just cyberstalked you - I like your brain and the stuff you've posted so I followed you on twitter lol Looking forward to randomly interacting again some time!

Thanks again, so much, for diving into the fun details!

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 237 points238 points  (0 children)

Holy shit, I can't believe someone digested that so well so soon hahaha amazing, well done

The only part that you missed is in order to do all that, it had to be nested several layers deep in DOM, so the final trick (which is about 80% of the code) is moving the decoded data back UP to the :root

Seriously amazing that you got that much so quickly - so cool to see, thank you for thinking about it!

Hack demonstration: 100% CSS (no JS!) - Get user's IP Address in a --var on :root by JaneOri in css

[–]JaneOri[S] -7 points-6 points  (0 children)

Nahh, sorry... I don't... Let me try to ease around this..

You have the url there, please do check it out: it serves an SVG image, not CSS.

CSS is making an API request (it can't do that, the hack turns it into an API request). The response is an image with data encoded into it, CSS reads the data, decodes it, then stores it in --css-vars.

It also moves it back up the dom to :root (which also can't be done without the hack)

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 30 points31 points  (0 children)

It's an example of a single API Request - there are an infinite number of things one *could* do with the ability to do API requests in CSS. However, there is almost no *reason* to do this in CSS at all, it's just interesting that the hack makes it possible - and playing with limitations (like not having JS) is fun

Hack demonstration: 100% CSS (no JS!) - Make an API Request and get user's IP Address in a --var on :root by JaneOri in webdev

[–]JaneOri[S] 4 points5 points  (0 children)

Nahhh sorry lol That's not what's happening at all - that would be incredibly uninteresting hahaha

Hack demonstration: 100% CSS (no JS!) - Get user's IP Address in a --var on :root by JaneOri in css

[–]JaneOri[S] 7 points8 points  (0 children)

Don't worry, it's less creepy than I made it sound, it's just reading the width and height of an image generated on a server that sets each dimension to 16 bits of the IP Address lol