8 ms·
Shoutout to APIs that do not enforce CORS preventing requests be made from FE without a need for a BE. There's so many toy apps I started building that would ha
by tomashubelbauer 2y ago
Shoutout to APIs that do not enforce CORS preventing requests be made from FE without a need for a BE. There's so many toy apps I started building that would have just worked if this was more common, but they have CORS restrictions requiring me to spin up a BE which for many one-off tools and personal tools just isn't worth doing and maintaining. Same with OAuth.
- aizk 2y agoThe only caveat I feel is that the speed of the API is definitely not comparable to something more purpose built for this kind of scale, but overall I'm happy as it works well enough that I don't have to think about it too hard.
- mikedelfino 2y agoI think Github Actions could be used for scheduled builds, so that the initial load would have random articles right in. Further requests could then be made in advance so users would not notice any delay from the API.
- aizk 2y agoDo you have any examples of that I can look at as a reference? I'm used to github actions just being my CI/CD build step checking tool.
- mikedelfino 2y agoI attempted to implement the schedule trigger [1] on GitHub Actions as an example, but it is not being triggered as I expected. It needs more digging if you're so inclined. Aside from that, the whole gist is that the initial data can be injected into the static files during the build step, or even saved as separate JSON files that the app can load instead of reaching out to the API. As long as you're willing to refresh the static data from time to time, of course. I created a basic example at https://schedbuild.pages.dev/ https://schedbuild.pages.dev/ with a rough, manual implementation of a build step. Frameworks like Next.js offer a more sophisticated approach that can render the entire HTML, allowing users to load the static page with the initial data already rendered without Javascript, and subsequent interactions taking over from there more seamlessly. If the Github Actions schedule feature is ever sorted out, in my opinion it's a reasonable alternative to setting up a backend just for this. [1] https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule https://docs.github.com/en/actions/writing-workflows/choosin...
- jahsome 2y agoin lieu of a cron server, I use scheduled jobs without any issues for a few production workloads on azure devops (AKA gh actions 0.1).
- mikedelfino 2y agoYou're right. I just checked the example project now and it's been updated hourly since then. It's just slightly delayed.
- deleted 2y ago[deleted]
- mikedelfino 2y agoEdit to the other comment: the cron job wasn't being triggered at first, but turns out it's just slightly delayed. The example has been updated hourly since then. You can use a schedule trigger [1] on GitHub Actions. The whole gist is that the initial data can be injected into the static files during the build step, or even saved as separate JSON files that the app can load instead of reaching out to the API. As long as you're willing to refresh the static data from time to time, of course. I created a basic example at https://schedbuild.pages.dev/ https://schedbuild.pages.dev/ with a rough, manual implementation of a build step. Frameworks like Next.js offer a more sophisticated approach that can render the entire HTML, allowing users to load the static page with the initial data already rendered without Javascript, and subsequent interactions taking over from there more seamlessly. In my opinion this is a reasonable alternative to setting up a backend just for this. [1] https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#schedule https://docs.github.com/en/actions/writing-workflows/choosin...
- bawolff 2y agoCould you just preload the next few entries before the user swipes?
- Klonoar 2y agoI kind of miss the era of JSON-P supported APIs. Feels like such a weird little moment in time.
- spencerchubb 2y agouse firebase cloud functions free tier
- jumploops 2y agoShameless plug for Magic Loops -- we run code in isolated MicroVMs and students love our lack of CORS enforcement, as the APIs they build can be easily integrated into their hackathon projects :)
- aizk 2y agoTell me more?
- jumploops 2y agoWe built an LLM-based no-code "all-code" tool for non-developers to automate their daily tasks. Counterintuitively, it's been picking up steam among student developers and professional devs due to how fast you can spin up API endpoints. We're currently working to build on this momentum, and are now shifting focus to existing devs. tl;dr - we use LLMs to create APIs that are run in Firecracker-based MicroVMs
- e12e 2y agohttps://magicloops.dev/ https://magicloops.dev/ ?
- jumploops 2y agoThat’s it!
- egonschiele 2y agonit: same-origin policy is the restriction. CORS isn't the restriction, it's the thing that helps you. CORS is the solution, not the problem.
- ahoka 2y agoYes, exactly. People who want to "disable" it have no idea how the web works. Developers have all kinds of misconceptions about what it is, I even heard someone saying it disallows backends to call their API.
- bawolff 2y agoAnd in particular CORS is the region you can read the wikkpedia api cross origin (unless you are doing jsonp, but hopefully they are using CORS because it is better in every way)
- tasuki 2y agoThere's many services to solve this pain point. I've used https://allorigins.win/ https://allorigins.win/ in the past.
- aizk 2y agoOh this looks neat!
- ahoka 2y agoNeet, if you want to leak your users' credentials in a XSS attack.
- pooper 2y agoI would only use something like this that requires absolutely no authentication. For example, I had a one page app that showed me instantly when the next shuttle(s) were scheduled for my stop. Instead of having to click through multiple steps, this allowed me to see it in one step. As far as I know, I was the only user for this thing I built and put up on gitlab pages. I don't know exactly because I didn't bother to track who visited the page.
- reynaldi 2y agoThis is the way to go, you wouldn't want to use a CORS proxy for something authenticated/with credentials (e.g. API key). But for public unauthenticated request, they work just fine.
- aizk 2y agoOh that explains why it's not a popular architecture.
- swyx 2y agothis ol' one as well https://github.com/Rob--W/cors-anywhere https://github.com/Rob--W/cors-anywhere
- 2y ago
- qudat 2y agoMany platforms can enable proxying through their service to avoid CORS issues: https://pico.sh/pgs#proxy-to-another-service https://pico.sh/pgs#proxy-to-another-service
- nathansherburn 2y agoA great way to get around this is with an edge function from deno deploy.
- anon3459 2y agoUsing nextjs with a serverless function acting as a proxy is pretty simple
- Liquidor 2y agoDon't you mean Node.js ? I don't see why you would use a full Next.js framework for just a reverse proxy.