Hacker News Reader

Comment by tomashubelbauer | Hacker News Reader

Shoutout to APIs that do not enforce CORS preventing requests be made from FE without a need for a BE. There's so many toy apps I started building that would have just worked if this was more common, but they have CORS restrictions requiring me to spin up a BE which for many one-off tools and personal tools just isn't worth doing and maintaining. Same with OAuth.

View on HN

nit: same-origin policy is the restriction. CORS isn't the restriction, it's the thing that helps you. CORS is the solution, not the problem.

Yes, exactly. People who want to "disable" it have no idea how the web works. Developers have all kinds of misconceptions about what it is, I even heard someone saying it disallows backends to call their API.

And in particular CORS is the region you can read the wikkpedia api cross origin (unless you are doing jsonp, but hopefully they are using CORS because it is better in every way)

There's many services to solve this pain point. I've used https://allorigins.win/ in the past.

Oh this looks neat!

Neet, if you want to leak your users' credentials in a XSS attack.

I would only use something like this that requires absolutely no authentication. For example, I had a one page app that showed me instantly when the next shuttle(s) were scheduled for my stop. Instead of having to click through multiple steps, this allowed me to see it in one step. As far as I know, I was the only user for this thing I built and put up on gitlab pages. I don't know exactly because I didn't bother to track who visited the page.

This is the way to go, you wouldn't want to use a CORS proxy for something authenticated/with credentials (e.g. API key). But for public unauthenticated request, they work just fine.

Oh that explains why it's not a popular architecture.

this ol' one as well https://github.com/Rob--W/cors-anywhere

These services are called CORS proxies! I recently made an updated list of the currently working free ones here: https://gist.github.com/reynaldichernando/eab9c4e31e30677f17...

Do note that these proxies are for testing only, and they are heavily rate limited.

For production use case, you might consider using Corsfix (https://corsfix.com)

(I am affiliated with Corsfix)

I kind of miss the era of JSON-P supported APIs. Feels like such a weird little moment in time.

The only caveat I feel is that the speed of the API is definitely not comparable to something more purpose built for this kind of scale, but overall I'm happy as it works well enough that I don't have to think about it too hard.

I think Github Actions could be used for scheduled builds, so that the initial load would have random articles right in. Further requests could then be made in advance so users would not notice any delay from the API.

Do you have any examples of that I can look at as a reference? I'm used to github actions just being my CI/CD build step checking tool.

I attempted to implement the schedule trigger [1] on GitHub Actions as an example, but it is not being triggered as I expected. It needs more digging if you're so inclined.

Aside from that, the whole gist is that the initial data can be injected into the static files during the build step, or even saved as separate JSON files that the app can load instead of reaching out to the API. As long as you're willing to refresh the static data from time to time, of course.

I created a basic example at https://schedbuild.pages.dev/ with a rough, manual implementation of a build step. Frameworks like Next.js offer a more sophisticated approach that can render the entire HTML, allowing users to load the static page with the initial data already rendered without Javascript, and subsequent interactions taking over from there more seamlessly.

If the Github Actions schedule feature is ever sorted out, in my opinion it's a reasonable alternative to setting up a backend just for this.

[1] https://docs.github.com/en/actions/writing-workflows/choosin...

in lieu of a cron server, I use scheduled jobs without any issues for a few production workloads on azure devops (AKA gh actions 0.1).

You're right. I just checked the example project now and it's been updated hourly since then. It's just slightly delayed.

Edit to the other comment: the cron job wasn't being triggered at first, but turns out it's just slightly delayed. The example has been updated hourly since then.

You can use a schedule trigger [1] on GitHub Actions.

The whole gist is that the initial data can be injected into the static files during the build step, or even saved as separate JSON files that the app can load instead of reaching out to the API. As long as you're willing to refresh the static data from time to time, of course.

In my opinion this is a reasonable alternative to setting up a backend just for this.

[1] https://docs.github.com/en/actions/writing-workflows/choosin...

Could you just preload the next few entries before the user swipes?

Shameless plug for Magic Loops -- we run code in isolated MicroVMs and students love our lack of CORS enforcement, as the APIs they build can be easily integrated into their hackathon projects :)

Tell me more?

We built an LLM-based no-code "all-code" tool for non-developers to automate their daily tasks.

Counterintuitively, it's been picking up steam among student developers and professional devs due to how fast you can spin up API endpoints.

We're currently working to build on this momentum, and are now shifting focus to existing devs.

tl;dr - we use LLMs to create APIs that are run in Firecracker-based MicroVMs

https://magicloops.dev/ ?

That’s it!

Many platforms can enable proxying through their service to avoid CORS issues: https://pico.sh/pgs#proxy-to-another-service

Using nextjs with a serverless function acting as a proxy is pretty simple

Don't you mean Node.js ? I don't see why you would use a full Next.js framework for just a reverse proxy.

A great way to get around this is with an edge function from deno deploy.

use firebase cloud functions free tier

Reply on news.ycombinator.com