SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Dev.to Comment API Broken for Non-JS Clients Due to Placeholder CSRF Token

0
·6 views

A developer discovered that dev.to's comment system is inaccessible to non-JavaScript scripting clients because the server-rendered CSRF token is a placeholder value rather than a functional one. The actual working token is injected at runtime by the page's JavaScript, meaning curl or terminal-based scripts receive an invalid token and get a 422 error despite holding a valid session cookie. Additionally, the POST endpoint for comments via the REST API returns a 404, making the comments API effectively read-only. The researcher, an AI agent publishing through dev.to's documented REST API, found that only a headless browser capable of executing JavaScript can obtain the correct token. The issue cost the developer a full day of debugging and leaves no programmatic path to post comments without a JS-capable client.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer Documents n8n-to-Ollama and MCP Integration Challenges in Containerised Setup

A developer building an automated workflow connected n8n, running as a container, to both Ollama and an MCP tool server, encountering multiple technical obstacles along the way. The Ollama integration succeeded using an HTTP Request node pointed at host.docker.internal, though the model responded to an OpenShift CLI question by referencing kubectl instead. Connecting the MCP tool proved harder, as n8n's containerised filesystem cannot access macOS binaries, making stdio transport unworkable and requiring a switch to SSE network transport. Configuring SSE also surfaced an API mismatch, with host and port parameters needing to be passed to the FastMCP constructor rather than the run method. Even after the server started successfully and was verified via curl, n8n still refused the connection, with the developer noting an unresolved question around whether host.docker.internal behaves identically under Podman as it does under Docker Desktop.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

OCI Sandbox Factory Now Runs on Oracle Cloud Free Tier Without a Payment Card

A developer has released a Free Tier edition of their OCI Sandbox Factory, a chat-based tool that automatically spins up and deletes Oracle Cloud sandboxes on a timer. The updated version runs entirely on Oracle Cloud Free Tier resources, requiring no payment method or paid tenancy. It provisions an Always Free Autonomous Database, NoSQL tables, Object Storage, and containerised apps on an Always Free Arm VM using Podman. Certain services like Kafka, Functions, and API Gateway are not available and are declined upfront to avoid mid-build failures. The setup deploys via a single Resource Manager stack in about 15 minutes, with all Terraform code publicly available on GitHub under the Apache-2.0 license.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Voice AI Market Set to Top $30B by 2028, Unlocking New Developer Opportunities

The global voice AI market is projected to exceed $30 billion by 2028, fueled by demand for smart assistants, in-car systems, and accessibility tools. Key growth areas for developers include edge-based on-device inference, multilingual text-to-speech, and voice cloning technology. These advances are enabling a new generation of APIs and SDKs that developers can build with today. Platforms offering high-fidelity, emotionally expressive speech synthesis across multiple languages are seeing rising adoption. The expanding ecosystem presents viable opportunities for both independent developers and commercial software products.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How to Build Chat Apps with Kimi K3 API Using Streaming and Multi-Turn Dialogue

Ace Data Cloud offers an HTTP endpoint for the Kimi K3 reasoning model, accessible via POST requests to api.acedata.cloud/kimi/chat/completions with bearer token authentication. Developers can send a JSON body with a model name and messages array, receiving responses that include the assistant reply, token usage, and a completion ID. The API supports streaming output by setting the stream field to true, enabling line-by-line response delivery suited for real-time applications. Multi-turn conversations are handled by passing the full previous assistant message back into the messages array, preserving reasoning and tool call fields. The reasoning_effort parameter controls K3's thinking depth, but currently only the value 'max' is supported, meaning developers should avoid building logic around undocumented values like 'standard' or 'high'.

0 comments Read more at DEV Community