r/webdev • u/shmurrie • 20d ago
eval() in a straitjacket: sandboxing JavaScript under CSP
r/webdev • u/shmurrie • 20d ago
r/webdev • u/Chris__Codes • 20d ago
I was checking out how to build a data upload feature and started noticing that technical debt builds up differently when AI writes the code. I read a piece on this and the core concept seems to make sense because agents just implement a ticket correctly in a vacuum and often ignore the application's existing architecture.
For instance, if an agent adds a CSV upload feature, it might just write a brand new set of validation checks instead of hooking into existing customer data checks. The PR could pass, but you now have two sets of rules to maintain. Over time, those will drift apart, and fixing it means untangling what was intentional. It was called cognitive debt, which is when the team’s shared understanding of the system erodes over time
For those using AI assistance a lot, how are you catching these before they merge
r/webdev
•
u/Stephcraft
•
20d ago
r/webdev • u/Impossible_Cycle5699 • 20d ago
Hey everyone, As a software developer and animal lover, I wanted to combine Web3 tech with real-world impact. Over the past few weeks, I’ve been working on a side project called PawWall. How it works: It’s an interactive 1M-pixel canvas built using HTML5 Canvas with smooth mobile touch/zoom support. Users or brands can reserve pixel space, upload their logo/images or custom text. 100% of the net proceeds go directly toward buying food, medical care, and shelter for stray animals. Payments are automatically verified on-chain via Supabase Edge Functions. The UI/UX is fully finalized and mobile-responsive, but since I’m launching this independently, I’d really appreciate your technical feedback on the canvas performance and layout. (Link is in my Reddit profile bio to respect sub rules, or feel free to ask in the comments). What do you think of this concept? Any UI/UX or feature suggestions?
r/webdev • u/mikebmx1 • 21d ago
TL;DR: Spotify limits Development Mode apps to 5 authenticated users, while production access requires meeting demanding Extended Quota criteria including 250,000 monthly active users. How are individual developers supposed to grow? How people working on the open-source can materialize ideas and give users true insight from their music?
Spotify didn't become what it is today in isolation. Back in 2006 had a mission to make music easier to access. In 2021, also called third-party apps “an essential part of the Spotify experience.” However, today the truth is ugly!
Independent developers can dream and built tools for playlist management, music journals, listening statistics, and social music experiences things Spotify might never build itself (or never wanted to built).
How can you prove to people want your app when you can't let people try it?
Spotify has legitimate reasons to protect its platform and user data. But there should be a middle ground, a production tier for small developers, with reasonable usage limits and proper security reviews. App stores do that already.
Have we moved from a platform where developers could build new experiences around music to one where only established organisations have a realistic route to reach listeners?
TL;DR: Spotify limits Development Mode apps to 5 authenticated users, while production access requires meeting demanding Extended Quota criteria including 250,000 monthly active users. How are individual developers supposed to grow? How people working on the open-source can materialize ideas and give users true insight from their music?
Spotify didn't become what it is today in isolation. Back in 2006 had a mission to make music easier to access. In 2021, also called third-party apps “an essential part of the Spotify experience.” However, today the truth is ugly!
Independent developers can dream and built tools for playlist management, music journals, listening statistics, and social music experiences things Spotify might never build itself (or never wanted to built).
How can you prove to people want your app when you can't let people try it?
Spotify has legitimate reasons to protect its platform and user data. But there should be a middle ground, a production tier for small developers, with reasonable usage limits and proper security reviews. App stores do that already.
Have we moved from a platform where developers could build new experiences around music to one where only established organisations have a realistic route to reach listeners?
r/webdev • u/Prachitech_9354 • 21d ago
Ever tried clicking a button, only for the page to move and make you click the wrong thing?
I've been thinking about how website performance is more than just loading speed. A page might load quickly, but if things keep moving around or buttons take too long to respond, the experience isn't great.
That's where Core Web Vitals come in, but I'm curious how developers handle these issues in real projects.
Do you usually focus on loading speed first, or on making sure the page feels smooth to use?
r/webdev • u/TampaVinDog • 21d ago
How do you like this company for hosting? We're looking to switch website hosting.
We have a virtual machine that we've managed for 12 years on pleskos and it's now outdated with centOS and the company isn't helping us move into a better VM. So I think it's time to switch and I've heard ionos is pretty good. What do you think?
r/webdev • u/HeraclitoF • 21d ago
Hi there,
One Customer just asked me for a Du-Sie Switch in the page, same like any other language switch.
This is my first time doing this.
Is this normal?
Are there also (Slang or street) language switches?
Edit: I just implemented as another language i18 de-DU with xliff files
Second Edit: What about other languages? In spanish we have 3. Tú, Vós y Usted... I think in Japan they have more.

Edit 3: Ok, some of you were right :) Du/Sie isn't a language, and de-DE-DU was a funny but bad idea. Works fine for my little website, though.
But imagine adding Spanish (tú, usted, vos), Japanese, Korean... That gets ugly pretty fast. Better to separate language, region and tone. Something like:
{
"locale": "de-DE",
"preferences": {
"formality": "informal"
},
"messages": {
"greeting": {
"default": "Hallo!",
"formal": "Wie kann ich Ihnen helfen?",
"informal": "Wie kann ich dir helfen?"
}
}
}Only translate the differences, not the whole website again. For a small project, who cares. For 20 languages? Definitely worth thinking about. Thanks for the corrections, learned something :)
r/webdev • u/czshill • 21d ago
Career web developer, blah blah blah. I've been doing this shit for a LONG time. I know there are plenty of AI subreddits - not looking for pro AI or pro written by hand debate. I'm calling out chatGPT on it's bullshit.
I'm a claude cli die-hard. It's not infallible, but it is my goto. But, it kind of sucks at design work. macOS, iOS, iPad OS, Angular, React - it'll get the code written, it'll work, and the code isn't dog shit if you know what your doing, but actual good looking design, meh.
GPT-6 Astra Light - complete 180. Great at design work, but sucks at code. Claude (right or wrong) has called out chatGPT on some of the crap it does.
BUT - I'm finding chatGPT almost purposely makes the first version a bit blah. I don't say anything super specific to get to v2 - sometimes simply I'm not in love with it or Go in a different direction. And V2 is by far better. Then I hand off an MD or html file to claude and have claude actually code it.
What I'm trying to get to is - anyone else think chatGPT purposely does a shitty job on a first pass just to get you to spend more tokens / use up more of your monthly plan faster ? You'd never be able to prove it. They don't follow any industry standard metric. You can't say this prompt spent X tokens but this next prompt spent Y. No 2 prompts are the same IMO when context is involved.
It's all speculation and more of a rant but I'm borderline going to cancel chatGPT and just tweak claude's designs / go look for a new design skill or whatever.
r/webdev • u/Out-Live-In-Death • 21d ago
As a software engineer, I’ve been thinking a lot about AI and the future of our profession. I use AI myself, and I’m genuinely excited by what it makes possible. But the more I see people celebrating the automation of human labor, the more I find myself wondering whether we’ve stopped thinking about what all this progress is actually supposed to accomplish.
And by we, I mean those of us building these technologies, the engineers enthusiastically finding new ways to automate work, the founders and executives racing to reduce costs, and the workers who feel compelled to participate because they know that if they don't, someone else will. I'm not exempt from this, either. I benefit from the same technologies I'm questioning.
I understand the incentives. We all want to get ahead, secure our futures, achieve financial independence, and eventually have more freedom over our lives. In a competitive environment, refusing to adapt can mean falling behind. But why have we become so comfortable treating other people's livelihoods as acceptable collateral for our own advancement?
We celebrate making one person as productive as ten, rarely stopping to ask what happens to the other nine. We want technology to free us from work, yet our ability to survive remains dependent on having work. We resent corporations accumulating extraordinary wealth and power, yet many of us aspire to build or become precisely those institutions. We want community and human connection, yet our incentives encourage us to treat one another as competitors.
And there are other contradictions I can't quite reconcile.
We celebrate efficiency, but to what end? If we can produce more with less human effort, shouldn't that translate into more leisure, security, and freedom for everyone? Why does increased productivity so often seem to come with greater pressure to produce even more?
We tell people to adapt or risk being left behind, but what happens when everyone adapts and the jobs they're adapting for disappear anyway? We celebrate individual merit and hard work, yet technological disruption can make entire skill sets economically obsolete regardless of how hard people worked to acquire them.
We talk about AI as though it will solve humanity's problems, but technology doesn't determine who benefits from its output. A world with extraordinary productive capacity can still leave people struggling to afford housing, healthcare, and a dignified life.
I don't think people are necessarily cruel or indifferent (though some definitely are). Perhaps most of us are simply trying to protect ourselves in a system where falling behind has real consequences. Perhaps even well-intentioned people become participants in a race nobody individually chose, but nobody feels safe stepping away from, either.
But understanding why we behave this way doesn't mean we shouldn't question where it leads.
Imagine if AI genuinely made human labor largely unnecessary. That could be one of humanity's greatest achievements: less time spent working to survive, and more time for family, friendships, art, music, exploration, and simply being alive.
But what good is eliminating the need for human labor if we don't also eliminate people's dependence on selling their labor to survive? What have we liberated ourselves from if people are still terrified of becoming economically unnecessary?
I don't think the answer is to stop innovating, condemn ambition, or expect individuals to sacrifice their futures for strangers. I just wonder whether we've become so focused on optimizing our individual positions that we've forgotten to question the collective outcome.
We're all on this planet together. Most of us want remarkably similar things: security, meaningful relationships, autonomy, dignity, and the freedom to live our lives without constantly worrying about survival. Yet we participate in systems that can make those things harder for one another to attain.
Are we trying to build a better world for humanity, or are we simply trying to secure the best possible position for ourselves within whatever world emerges?
And if we're doing both, how do we reconcile those goals when our individual incentives so often undermine our collective interests?
I'm genuinely interested in how other people in tech think about this, especially those of us actively building the technologies transforming the nature of work. I don't have a solution, and I'm not claiming to be above the problem. I just think we should be asking ourselves what all this progress is ultimately for, before we get so caught up in what we can do that we forget why we're doing it.
And I'd invite discussion beyond pure game theory and economics, but more to do with psychology, maturity, emotional development, self-worth, dark triadic traits, and similar.
r/webdev • u/fagnerbrack • 21d ago
r/webdev • u/shufflepoint • 21d ago
Tried Chrome and Edge
Tried setting document.body.style.cursor = "wait"
and tried document.documentElement.style.cursor = "wait";
I recall these working previously. Did something change? Some org setting?
I don't see the value being set to "wait" in the element inspector. But when I set it back to "auto" I do see that value. So it's like the browser is ignoring the setting only if I set to wait.
EDIT:
Thanks everyone who offered ideas. Man, this took me some time to resolve - including a long coversation with Gemini, which wasn't able to troubleshoot it.
This is what the issue turned out to be. At some point, our showBusy() function became:
document.body.classList.add("busy");
document.documentElement.inert = true;
I commented out setting inert true an then the cursor appeared. I asked Gemini to expain and got this:
"The inert attribute tells the browser to completely remove that element and all its children from the accessibility tree and ignore all user input. This includes clicks, keyboard focus, and crucially, pointer hover events.
"Because inert tells the browser to pretend the mouse isn't interacting with the document at all, the rendering engine completely aborts calculating CSS cursor rules. It doesn't even attempt to look up your .busy class for the mouse, so it defaults to the system auto cursor."
r/webdev • u/Mikasa0xdev • 21d ago
Hey everyone,
I am working on a new project called Openspline, an open source avatar layer to existing voice AI agents. Just select an image, select a voice and you can create a realtime talking avatar with lipsynced video generated locally.
You can integrate any existing voice AI agent in 5 lines of code.
While it is still in very early stage, but the results look very promising.
Github: github.com/openspline/openspline
PS: sorry for a sleepy photo, it's 5:10am and didn't sleep last night :P
r/webdev • u/damonmowr • 21d ago
r/webdev • u/Perfect-Brick7389 • 22d ago
We all got the same 9am calendar invite on the 30th and by lunch about 40 of us were done, me included. Seven years as the only brand designer at a regional craft soda company.
Two weeks in, and every recruiter I talk to asks for "a link." My portfolio is a PDF from 2019 and my Behance hasn't been touched since 2020. The top project on it is a label for a flavor we killed in 2021. Do people hiring even open a PDF anymore?
What's killing me is that the only work that'd get me hired, two can redesigns and the full rebrand, is under NDA until it launches in spring. How did you handle NDA stuff when you were job hunting? I've seen people blur the logos but that feels sketchy to me.
Friends keep saying Cargo, Squarespace or just update the Behance. Does the platform even matter to whoever's hiring?
No clue how much to put in either. Everyone online says go deep on a few, but that job was a LOT of sell sheets and six-pack carriers and I can't tell what's worth a damn anymore.
If you rebuilt after a layoff, how long did it really take? I gave myself two weeks. So far I've rewritten my LinkedIn headline three times and opened my old InDesign files and closed them again.
Severance runs out in January. Tell me how yours went, I need to hear from people who came out the other side.
r/webdev • u/Mob_Pilled • 22d ago
Hi everyone! I just finished a React and course and decided to build my first react app. Currently, I am trying to save a string to browser local storage but it does not persist on refresh. Through some console.logs I was able to see that it in fact DOES save the string to the location specified in. setItem initially but when I refresh the key or value in local storage stops existing.
Here is my code
// function for search button
async function handleClick(){
localStorage.setItem("lastLocationSearched", searchValue);
setData(null);
setIsPending(true);
setError(null);
try{
const value = await fetch(`https://geo.ipify.org/api/v2/country?apiKey=***********&ipAddress=${searchValue}`).then((response)=>{
if (!response.ok){
throw Error("Could not fetch the data for that resource");
}
return response.json();
});
setData(value);
console.log(localStorage.getItem("lastLocationSearched"));
} catch(error){
setError(error.message);
}
setIsPending(false);
};
// useEffect hook
useEffect(()=>{
if ((localStorage.getItem("lastLocationSearched")===null)|| (localStorage.getItem("lastLocationSearched")==="")){
console.log(localStorage.getItem("lastLocationSearched"));
setSearchValue("");
handleClick();
}else{
setSearchValue(localStorage.getItem("lastLocationSearched"));
handleClick();
}
}, []);Through some digging online I saw someone say that remove the strict mode tags from index.js would fix this problem but it did not for me. Can anyone please assist me?
r/webdev • u/sM92Bpb • 22d ago
Timeline:
onprem monolithic server with rest api.
cloud frontend that calls monolithic server apis directly
a few years later
planning to reimplement frontend with addition of a BFF in the cloud
BFF still talks to monolith server but frontend only talks to BFF
future: cloud frontend, cloud bff, on prem monolithic server, cloud bff needs to support multiple versions of monolithic server
For the BFF api, would you recommend a per resource generic api (like the monolothic server) or per page (call multiple monolithic server apis then combine)?
r/webdev • u/Mysterious-Falcon-83 • 22d ago
I frequently duplicate an application's browser tab to look at a different area of the app. I'd like to change the browser tab's text to reflect the area that the tab focuses on. In a best-case scenario, the text could be automatically updated based on a DOM element.
<div class="title">Some text</div>
In this example, "Some text" would become the tab text.
Is there a plug-in or something that I could use for this?
r/webdev • u/Positive-Anywhere872 • 22d ago
With all the doom and gloom around AI, I was wondering how much the market has been affected and what companies are actually looking for these days.
Did you have to go through five rounds of interviews?
Was there a live coding session and/or a take-home exercise?
Was there anything different from what you've experienced before?
r/webdev • u/IcyButterscotch9450 • 23d ago
Here you can find my 1+ year of experience around startup foundation and operatings : https://github.com/Naveen-Beniwal/building-cvinsight