CHIPS Partitioned Cookies Limit Tracking But Cannot Restore Chat Sessions Alone

·1 views

CHIPS (Cookies Having Independent Partitioned State) isolates embedded cookies per top-level site, meaning a chat widget on two different sites cannot share the same cookie. While this design reduces cross-site tracking, it also means CHIPS is not a shared identity system and cannot reconstruct a conversation on its own. Reliable session restoration requires three server-side components: an opaque conversation handle stored in the cookie, a server mapping that handle to the correct session, and a fallback mechanism like explicit sign-in when storage is unavailable. Developers should also not assume a cookie was accepted or retained simply because storage APIs appear available, as privacy modes, sandbox flags, and browser policies can silently block reads or writes. A write-read-delete probe inside the actual iframe is recommended to verify real storage behavior in a given browser and embedding context.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Compound Component Patterns Can Fix Brittle, Prop-Heavy React UI Libraries

A developer refactoring modular landing page cards found that adding boolean props like 'hasBadge' and 'isCompact' quickly made components fragile and hard to maintain. Every new client layout request required editing core component files, risking regressions across the entire UI. The root cause was treating components as rigid black boxes rather than flexible composition primitives. Switching to compound component patterns — where structural control is handed back to the consumer — kept styles encapsulated while making layouts far more extensible. The approach eliminates deep prop drilling and allows new layout variations without touching core component logic.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Async-First Teams Still Need Occasional Sync Meetings

A software professional working remotely from Vancouver for a Japan-based fully flexible organization shares lessons learned about asynchronous communication. While async work offers benefits like personal pacing and automatic written records, he found that complex or stalled discussions often drag on for hours or days without resolution. AI tools have made writing documents easier but have not reduced the burden on readers, particularly in a non-native language context. To counter this, he began scheduling short synchronous meetings for complicated topics, using written documents to share context beforehand and the meeting itself to reach quick decisions. His conclusion is that async communication is a useful tool, not an absolute rule, and blending both modes reduces overall communication costs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds three self-made bugs after testing his security extension on 20 real sites

A developer building 'QuickAudit', a browser extension that runs OWASP-style security checks on web pages, discovered three significant bugs in his own tool after testing it against 20 real-world websites. One flaw caused the extension to audit Cloudflare bot-protection interstitial pages instead of the actual target site, producing false security findings. A second bug stemmed from a misread web specification, incorrectly flagging the 'origin-when-cross-origin' Referrer-Policy as high-risk when it actually restricts cross-origin data exposure. A third issue involved flagging sites like Stripe and NASA for using 'X-Frame-Options' without a modern CSP directive, a technically outdated but still widely supported and functional security header. The developer used these findings to overhaul parts of the extension's architecture, adding challenge-page detection and revising how low-severity informational findings are surfaced to avoid alert fatigue.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FINRA Short Volume and OSV Vulnerability Data: Free APIs Developers Often Misread

Two widely used public datasets — FINRA's daily short volume file and OSV.dev's security advisory API — are freely accessible with a single HTTP request and require no account or API key. FINRA publishes per-symbol short volume data every trading day, but analysts frequently conflate it with short interest, which measures persistent open positions rather than intraday trading flow. Similarly, OSV.dev aggregates vulnerability advisories across major package ecosystems, and a scan of three commonly pinned library versions returned 70 advisories, including 24 rated High or Critical. Key pitfalls include silently dropping advisories with missing severity ratings and treating a version match as confirmed exploitability, when it only indicates a package is in scope for triage. Both datasets are authoritative but carry narrower meanings than their headline figures suggest, and accurate interpretation depends on understanding their underlying methodology.

0 comments Read more at DEV Community