Guide to safely fetching user-supplied URLs from Cloudflare Workers

·3 views

A developer explains how to fetch user-provided URLs from a Cloudflare Worker without exposing internal resources to request forgery. The post notes that Workers avoid some risks, such as cloud metadata services on localhost, but can still be directed at internal hostnames, origins trusting only Cloudflare IPs, or very large files. It lists the validation checks applied in order, including protocol and port restrictions, rejection of reserved hostnames, and resolving DNS over HTTPS to confirm all addresses are public. The article also covers IPv6 edge cases where IPv4 addresses can be embedded, and manual redirect handling so each hop is re-validated.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Python script or Firecrawl for llms.txt in 2026: the author's pick and why

The author recommends a small Python script run in CI for repo-hosted docs, which took about 47 minutes to build and costs nothing per deploy. Firecrawl's hosted generator is better when the source isn't under your control or when an llms-full.txt is needed from a live site, though its auto-written descriptions usually need rewriting. For very small sites, manually writing the file can be quicker than either option. The author also built a free, browser-based llms.txt generator after finding that other tools either routed sites through third-party servers or output bare links without descriptions. The piece walks through the llms.txt spec, including the required H1, optional blockquote, H2 link sections, and an Optional section for skippable content, and it describes how the author's 38-page documentation set was structured and generated.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Next.js image SEO: where next/image defaults fall short on LCP, sizes and alt text

The next/image component handles much of image optimization automatically, including srcset generation, WebP delivery, lazy loading and layout stability. Four areas still require developer decisions: identifying the LCP image, setting accurate widths, writing meaningful alt text, and ensuring images appear in the HTML. Lazy loading is usually wrong for a large hero image that serves as the LCP element, so the author recommends eager loading with fetchPriority set to high. Omitting the sizes prop causes the browser to download oversized files, so it should match the layout grid. Because alt is required but can be filled with empty or generic text, the article suggests making alt text part of the content model so editors supply it when adding images.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ONNX Launch Success Does Not Confirm GPU Acceleration, Experts Warn

A working ONNX application with correct-looking output does not prove the model ran on a GPU, since the inference runtime may fall back to other execution providers. Unsupported graph operations can run elsewhere, or a requested provider may fail to initialize without obvious signs. The guidance urges developers to record their hardware, drivers, and runtime settings and to confirm that the intended backend is actually active. It also recommends measuring warm and cold runs, checking memory and utilization, and verifying output quality alongside speed. Finally, it notes that inference is often only one part of end-to-end pipeline time, and that VRAM alone is a poor predictor of performance.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Sonner Alternatives for React Toasts Compared on Size, Stacking and Swipe

A comparison of Sonner with react-hot-toast, React-Toastify and a source-owned toast from Wingo UI examines their APIs, stacking behavior, swipe dismissal, screen reader support and bundle size. The article notes that react-hot-toast is the smallest at about 4.8 kB gzipped, while React-Toastify offers progress bars, a queue limit and a notification history. A source-owned toast suits teams that need to change stack behavior, phone layouts or accessibility details directly in their code. Sonner remains by far the most downloaded of the group, with about 50.8 million weekly npm downloads, and includes stacking, swipe and promise toasts by default. The author discloses that they build the Wingo UI Toast, so the comparison is written by a vendor.

0 comments Read more at DEV Community