How Cloudflare cached a 404 and blocked a new page for nearly an hour

·4 views

The team behind Escrozon, a digital asset escrow marketplace, discovered that a newly deployed landing page kept returning 404 errors to visitors for close to an hour despite a successful deployment. The root cause was Cloudflare caching a 404 response that the team had inadvertently triggered by checking the new URL before it went live. Because their Cloudflare cache rule applied a one-hour edge TTL to all HTML responses including error pages, the stale 404 persisted at Cloudflare's edge even after the origin server began correctly serving the page. The issue was further complicated by Cloudflare's per-data-center caching, meaning users in different regions saw inconsistent results. To prevent recurrence, the team recommends avoiding pre-deploy requests to public URLs, setting short or no-cache TTLs for 4xx responses, and automating cache purges as part of the deployment pipeline.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Kram, a Lightweight macOS File Organizer That Stays in Its Lane

A developer has released Kram, an open-source macOS tool designed to automatically sort cluttered folders by organizing files into categorized subfolders based on file type. The tool was built after its creator grew frustrated with a disorganized Downloads folder containing hundreds of mixed files. Kram operates entirely locally, never uploading files to external servers, and only works on folders the user explicitly selects — leaving system files untouched. Currently a command-line tool, it is being tested against edge cases such as duplicate filenames, files without extensions, and permission-restricted items. Planned features include a dry-run preview mode, undo functionality, custom sorting rules, and eventually a native macOS GUI.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How CSRF Attacks Work and How to Protect Your Frontend Application

Cross-Site Request Forgery (CSRF) is a security attack where an authenticated user is tricked into unknowingly triggering an unintended action on a web application. Attackers exploit the browser's automatic cookie-sending behavior to make malicious requests appear legitimate. One of the most effective defenses is the use of CSRF tokens — randomly generated, cryptographically secure values that the server associates with a user's session. When the frontend makes state-changing requests such as POST, PUT, PATCH, or DELETE, it must include this token in a custom HTTP header, which the backend then validates before processing the request. Importantly, CSRF tokens serve a distinct purpose from authentication tokens, as they verify the legitimacy of the request source rather than the identity of the user.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Tool Calling Extends LLM Capabilities Beyond Text Generation

Tool calling, also known as function calling, is a method that enables large language models to interact with external systems such as APIs, databases, and knowledge bases. Rather than relying solely on trained knowledge, an LLM is provided a set of tools — essentially functions — and decides which ones to invoke based on a given user query. In frameworks like LangChain, tools are defined using decorators that wrap standard functions, while providers like Groq supply the infrastructure to run models such as LLaMA 3 via API keys. Key benefits of tool calling include real-time data access, reduced hallucinations, and extended model capabilities, though it also introduces concerns around token costs, latency, and security risks. The next evolution of this concept is the Model Context Protocol (MCP), which builds further on the tool-calling paradigm.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How one zero-dependency pricing package keeps displayed and charged amounts identical

A developer at Munchable built a single shared pricing package to ensure the price shown to users is always the price charged — across 24 currencies, a Next.js site, and an Expo mobile app. The package has zero runtime dependencies, preventing the Stripe SDK from being pulled into lightweight landing page components that only need to display a number. All prices derive from a single source-of-truth integer (1000 pence for £10), replacing a previous setup where Stripe's Adaptive Pricing caused the local amount to fluctuate with exchange rates. Hardcoded conversion rates include a 4% buffer to absorb Stripe's settlement fee and rate drift, ensuring £10 in list revenue stays close to £10 after currency conversion. Local prices are then rounded up — to the nearest .99 for decimal currencies, or to a scaled round step for non-decimal ones — so the rounding logic for display and for billing lives in one place.

0 comments Read more at DEV Community