How one developer secured a static SPA with a targeted Content Security Policy

·1 views

A developer building Quietbench, a static single-page application, added HTTP security headers after the scaffolded template shipped with none by default. Standard headers like X-Frame-Options and X-Content-Type-Options were straightforward to implement, but the site's API tester — which fetches arbitrary user-supplied URLs — required keeping connect-src intentionally open to avoid silently breaking functionality. The developer noted that Vite's dev server ignores the _headers file entirely, meaning headers must be tested via Cloudflare Pages using wrangler pages dev dist to reflect real production behavior. Unused scaffold dependencies including @google/genai and express were also removed, cutting 121 packages and reducing unaudited attack surface. The key takeaway is that a Content Security Policy need not be uniformly strict, but should be tightly enforced in areas most critical to the application.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer Builds Free NATO Phonetic Alphabet Converter to Eliminate Phone Spelling Errors

A developer created a free online tool that converts any text into the NATO phonetic alphabet, inspired by a frustrating phone call where repeated letters were misheard. The tool, available at allinonetools.net, requires no signup and instantly transforms letters into standard code words such as Charlie, Hotel, Alpha, and Tango. The NATO phonetic alphabet uses distinct words for each letter to prevent confusion caused by similar-sounding characters, particularly over poor connections or across different accents. While originally associated with military and aviation use, the developer notes the system is equally practical for customer support agents, remote workers, and anyone spelling out emails or license keys by phone. The project highlights how a decades-old communication standard remains a simple, effective solution to everyday miscommunication.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds MCP Server to Make Portfolio Queryable via Claude Desktop

A developer named Ayush grew frustrated with static portfolio sites that display projects as mere lists of links and decided to build an interactive alternative. He created a Python-based MCP (Model Context Protocol) server using FastMCP that exposes nine of his projects as five queryable tools, allowing AI clients like Claude Desktop to fetch live, structured data on demand. Users can ask natural-language questions such as 'what has Ayush built with FastAPI?' and receive answers pulled directly from the server rather than from cached or guessed information. The project data is stored in plain Python dictionaries, keeping the setup lightweight with no database required. During development, Ayush encountered several setup hurdles, including path differences for the Windows Store version of Claude Desktop and the model sometimes answering from its own training data instead of calling the connected tool.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FROST Framework Proposes Constitution-Based Governance for Multi-Generation AI Agents

FROST is an AI agent framework designed to address governance gaps left by popular tools like LangChain, CrewAI, and AutoGen, which rely on soft, prompt-level constraints rather than hard architectural rules. The framework enforces boundaries through four code-level mechanisms: a hierarchical read-only memory store, ancestor-validated SOP workflows, explicit generation limits on agent spawning, and selective output inheritance with audit logs. These controls ensure that even if a large language model hallucinates or attempts unauthorized actions, the system rejects the operation at the code layer rather than relying on instructions. The design is aimed at organizations running long-lived, compliance-sensitive agent systems where dozens of agents — some self-spawned — must operate within defined permission boundaries. FROST positions governance not as an add-on patch but as a core part of the system architecture from the outset.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

BOLA: The API Security Flaw Topping OWASP 2023 and How One SaaS Dev Fixed It

A developer running a security audit on his growing multi-tenant SaaS platform discovered a critical vulnerability called BOLA (Broken Object Level Authorization), flagged at the highest severity level. BOLA, ranked number one on OWASP's 2023 API security list, occurs when an API fails to verify whether the logged-in user actually owns the object they are requesting by ID. The flaw is notably easy to exploit — attackers simply swap an object ID in a request URL, query string, header, or body to access data belonging to other users. Real-world examples cited by OWASP include unauthorized access to thousands of online store revenue records and remote control of vehicles not owned by the attacker. The developer used the findings as a starting point to understand and remediate the vulnerability across his platform, distinguishing BOLA from the related but distinct BFLA (Broken Function Level Authorization) flaw in the process.

0 comments Read more at DEV Community