X-Frame-Options Being Deprecated: Why CSP frame-ancestors Is the Better Choice

·1 views

Clickjacking attacks trick users into clicking hidden buttons on malicious sites that load a target page inside a transparent iframe. Two HTTP headers defend against this: the legacy X-Frame-Options and the modern Content Security Policy directive frame-ancestors, with the former now considered deprecated. Security guidance recommends using CSP frame-ancestors with strict values like 'none' or 'self' instead of broad wildcards, which leave sites fully exposed. Developers can quickly check their exposure using a simple curl command to inspect response headers for either directive. Sites intentionally embedded by third parties, such as payment widgets, should maintain a minimal, explicitly documented allowlist rather than opening framing permissions entirely.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds MCP-specific observability tool after generic APM tools fell short

A developer created mcpobs, an open-source observability tool designed specifically for the Model Context Protocol (MCP), after finding that standard APM tools only surfaced generic HTTP-level data for MCP tool calls. Existing tracing solutions could not distinguish between actual tool failures, missing tools, argument validation errors, or expected 401 responses that are part of the MCP auth handshake. The tool can be installed via pip and classifies failures into actionable categories, tracks progress on long-running tools in real time, and links downstream database, HTTP, and LLM calls within the same trace. Released under the Apache-2.0 license, mcpobs is self-hostable via Docker Compose and requires no account to run. A hosted version is also available on an invite-only basis at mcpobs.dev for users who prefer not to manage the pipeline themselves.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Safe, Production-Ready AI Agents in Laravel

A technical guide published on DEV Community outlines best practices for deploying AI agents in Laravel beyond the prototype stage. The article warns that dangerous agents are not those that give wrong answers, but those that confidently take harmful actions, loop uncontrollably, and leave no recoverable audit trail. It argues that Laravel's existing primitives — queues, validation, policies, transactions, and logging — make it well-suited for building reliable agent systems when used correctly. Key recommendations include persisting every agent run as a durable record, moving reasoning to queued jobs, enforcing approval gates for high-risk actions, and treating all model output as untrusted until validated. The guide emphasizes that a production AI agent should be treated as a supervised workflow engine, not a chatbot, with strict tool contracts, budget limits, and shadow-mode evaluation before any prompt changes go live.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineer Warns Multi-Cloud Strategy Cost More Than the Risk It Prevented

A software engineer at a tech company reflects on a decision to adopt a multi-cloud infrastructure across two providers, driven by concerns over vendor dependency and contract leverage. Over two years, the strategy proved more costly and operationally complex than anticipated, without the feared provider-wide outage ever occurring. Because maintaining true workload portability required avoiding each platform's best managed services, the team effectively paid cloud prices while rebuilding data-centre-level infrastructure themselves. The human toll was significant — on-call procedures, hiring, and team expertise all suffered as engineers were spread thin across two platforms instead of deeply skilled in one. The author now advocates a more targeted approach: keep data portable, use infrastructure-as-code, and address only the specific risks that genuinely threaten the business.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Visual diff tools aim to fix AI coding agents' blind spot on UI regressions

AI coding agents excel at fixing backend bugs using test failures and error logs, but lack the ability to visually verify UI changes they make, often shipping broken layouts undetected. Unlike code errors, visual regressions such as shifted buttons, reflowed cards, or missing shadows rarely trigger automated test failures, leaving agents to self-report UI changes as correct without any visual confirmation. A proposed solution involves capturing cloud-rendered screenshots on every pull request, diffing them against a baseline, and posting cropped before-and-after comparisons directly in the PR where agents already check for failures. An AI judge pre-labels each visual change as either an intentional restyle or an unintended regression, allowing the agent to review only the relevant pixel-level crops rather than full-page screenshots. Using a set of MCP-connected tools, the agent can then list affected UI stories, inspect diffs, fix regressions, and approve intended changes, completing the visual review loop without manual intervention.

0 comments Read more at DEV Community