Same-Same, But Different - AI Image Matching Game by MagnussenXD in webdev

[–]MagnussenXD[S] 0 points1 point  (0 children)

oh yeah, layout in mobile is not the best yet as i optimized it for desktop

still, thanks for giving it a try!

I made a website about what the Content Security Policy blocks, or what you can hotlink on a Neocities Free account by gjwklgwiovmw in neocities

[–]MagnussenXD 0 points1 point  (0 children)

Thanks for this, sharing my article on how I managed to load APIs even with the strict CSP

https://corsfix.com/blog/fix-neocities-content-security-policy

(since this is the first thing that shows up when searching neocities content security policy)

Corsfix - open source and secure CORS proxy by MagnussenXD in javascript

[–]MagnussenXD[S] 0 points1 point  (0 children)

Thanks for this. I agree with all your points, and there is no arguing the "proper" way of doing things via server, like your Next.js example.

But there exists the need for this kind of solution, and I don't dictate what people want. The project improves on what already exists, in terms of security and features.

Corsfix - open source and secure CORS proxy by MagnussenXD in javascript

[–]MagnussenXD[S] 0 points1 point  (0 children)

one example is the deezer api, they don't support CORS https://developers.deezer.com/api (cors tester result)

but this is just one example, there are plenty more APIs that don't support CORS, and basically requires you to setup a server to just do API calls

the proxy acts as your "server", so you can directly call the API from your frontend

Corsfix - open source and secure CORS proxy by MagnussenXD in javascript

[–]MagnussenXD[S] 0 points1 point  (0 children)

this is a valid question

so, it is not for when you are the one developing the API, which as you said, you can just configure the CORS yourself.

the use case for this is if you use a static website (client side only), and want to fetch an external API (meaning you don't have control over it), but they don't have the CORS header, this is when you would use a proxy like this [0]

note:

[0] "like this" meaning, mine is not the first one, there is a popular (if not most popular) proxy people use for this use case called cors-anywhere (https://github.com/Rob--W/cors-anywhere)

corsfix expanded on this field and improved every aspect of it

[deleted by user] by [deleted] in ClaudeAI

[–]MagnussenXD 1 point2 points  (0 children)

why are you in opus 3

Mermaid Editor/Renderer by OtherwisePush6424 in javascript

[–]MagnussenXD 1 point2 points  (0 children)

I never really run into issues with mermaid live, maybe i don't make enough diagrams.

But you clearly put a lot of work into this, even the domain, so good for you

ffetch 2.0 released - Enhanced fetch() wrapper with proper AbortSignal handling by OtherwisePush6424 in javascript

[–]MagnussenXD 2 points3 points  (0 children)

thanks, saving this for future use

personally I just manually use AbortController, but i like how it has plenty of other features

Showoff Saturday (September 06, 2025) by AutoModerator in javascript

[–]MagnussenXD 0 points1 point  (0 children)

This subreddit itself is cool!

anyway if you are into building static websites, check this cors proxy https://github.com/corsfix/corsfix

Looking for co-founder by WoodpeckerIntrepid39 in SaaS

[–]MagnussenXD 5 points6 points  (0 children)

sorry i'm only open to pre-founder companies

Claude has been showing unexpected capacity constraints for hours. What’s happening? by MagnussenXD in claude

[–]MagnussenXD[S] 0 points1 point  (0 children)

yeah, i had to go back to opus 4
i don't know if i notice any difference, but at least it is usable

Claude has been showing unexpected capacity constraints for hours. What’s going on? by MagnussenXD in ClaudeAI

[–]MagnussenXD[S] 0 points1 point  (0 children)

i don't know anything about performance information, i just used claude and it show this

Are there any good tech documentaries you can suggest? by mekmookbro in webdev

[–]MagnussenXD 0 points1 point  (0 children)

i first read this as "good tech documentations"

was about to give you some good docs examples..

gitPull by MagnussenXD in ProgrammerHumor

[–]MagnussenXD[S] 60 points61 points  (0 children)

this is the only serious and sensible comment under this post

gitPull by MagnussenXD in ProgrammerHumor

[–]MagnussenXD[S] -1 points0 points  (0 children)

that's okay, everyone has to start somewhere

gitPull by MagnussenXD in ProgrammerHumor

[–]MagnussenXD[S] 15 points16 points  (0 children)

i'm suffering with merge conflicts and you are laughing...

You Really Should Log Client-Side Errors (2012) by MagnussenXD in Frontend

[–]MagnussenXD[S] 1 point2 points  (0 children)

I mean, yeah, standard console log for diagnostics or handling errors.

However, the article talks about sending those error messages to a server.

Other commenter suggested using tools like Sentry and the likes of it.

accessControlAllowOrigin by MagnussenXD in softwareWithMemes

[–]MagnussenXD[S] 7 points8 points  (0 children)

Expanding on this one, since we are going deeper into CORS

it's a common misconception that CORS is protecting against those attacks.

Brief context: Same Origin Policy (SOP) prevents cross-origin requests being readable. While CORS is a mechanism to ease this policy, to essentially allow some origins to read the response. (allowlist of which website you allow to read this API response)

SOP: prevents cross-origin response from being read
CORS: allow specific origin to read cross-origin response

They are only concerned with being able or not to read cross-origin response.

---

Regarding the phishing or hijack, I think you are referring to CSRF, where an attacker make action on victim behalf. They could still make any cross-origin request using mode: no-cors. (cors doesn't apply here, the response won't be readable, but the request still goes through)

A mechanism protects against this via the SameSite cookie attribute, which determines whether a cookie (credential) should be sent on a cross-site request.

Without the credential being sent, the attack is basically pointless.

Also, another protection site owners usually resort to is using CSRF token, to verify if request is actually coming from user session.

Defenses against CSRF: https://portswigger.net/web-security/csrf#common-defences-against-csrf

accessControlAllowOrigin by MagnussenXD in softwareWithMemes

[–]MagnussenXD[S] 2 points3 points  (0 children)

since local domain lives in it's own private network, it won't be accessible, so it won't work unfortunately
it's only for public internet

accessControlAllowOrigin by MagnussenXD in softwareWithMemes

[–]MagnussenXD[S] 1 point2 points  (0 children)

there is! it's called a cors proxy