Pay button 403 error traced to clashing Referrer-Policy and origin check

·3 views

For several days, customers pressing Pay by card on CloseQuotely invoices were shown a Forbidden page and Stripe was never reached. The cause was a privacy setting, no-referrer, which made browsers send an Origin header of null on same-site form posts. This clashed with a CSRF origin check that rejected anything other than the app's own origin. The team fixed it by using same-origin referrer policy on invoice and quote pages and accepting a null Origin only when Sec-Fetch-Site confirms a same-origin request. Refusals now redirect customers back to the bill with a message and are logged. Card payments have been working again since the fix.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Browser-based GIF compression and resizing without uploading files to a server

Chat apps still enforce upload limits on GIFs, and sending clips to online compressors raises privacy concerns. The approach described decodes and re-encodes GIFs entirely inside a browser tab, using a Web Worker to keep the main thread responsive. Memory is managed with a total pixel cap and downscaling for oversized files, while frame delays are clamped to 20 ms to avoid clients playing them slower. Opaque animations are further shrunk by writing only changed pixel regions between frames. To hit byte targets, the tool steps through a fixed sequence of color, scale, and frame reductions until the output fits.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How an iPhone Microphone Is Turned Into a Decibel Meter

A developer at W Lab describes building Noise Meter, an iPhone app that displays sound levels in decibels and logs them overnight. The core challenge is disabling iOS's default microphone processing, such as gain control and noise suppression, which would distort readings. The app applies standard frequency weightings (A, C, and Z) using filters derived from IEC 61672-1, adapted to the device's sample rate. Measurements are averaged into per-second records that track both energy-based equivalent levels and short-term peaks. The post also explains that dBFS readings must be converted to dB SPL to match standard sound level meter output.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Contao Edit-Multiple Flaw Let Restricted Users Modify Folders Outside Their Filemount

A vulnerability tracked as CVE-2026-126662 in the Contao content management system allows backend users restricted to one filemount to change folders outside that boundary via the Edit-Multiple bulk action. The flaw is an access-control bypass and requires an existing backend account with file-manager permissions. Contao lists affected versions as 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6, with fixes available in the corresponding patched releases. The advisory does not establish that outside files are executable, that anonymous visitors can exploit it, or that exploitation has occurred. Administrators are advised to update, verify restricted-user behavior, review file-change logs, and compare affected folders against trusted backups if the boundary may have been crossed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Nvidia's ASPIRE Lets Robots Write, Debug and Reuse Their Own Skills

Nvidia researchers, working with several universities, have introduced ASPIRE, a framework that lets robots generate their own control code, detect failures, repair them, and store verified fixes as reusable skills. Unlike most robot learning systems that discard solutions after each task, ASPIRE is designed so that experience accumulates over time. It relies on code-as-policy, where a language model produces Python control programs rather than raw motor commands, making the logic readable and transferable across robot bodies and environments. The system operates in a continuous learning loop supported by fine-grained execution traces that help pinpoint exactly where a multi-step task went wrong. Nvidia released an initial skill library in June 2026 and a broader open-source version, ASPIRE v1.0, in October 2026.

0 comments Read more at DEV Community