XMLHttpRequest (XHR) objects are used to interact with servers. You can retrieve data from a URL without having to do a full page refresh. This enables a Web page to update just part of a page without...

The xmlhttprequest-ssl library used in several Node.js projects can be tricked into running unwanted code.

htmx 4 has been released, featuring a transition from XMLHttpRequest to the fetch() API, enhancing streaming capabilities. Key updates include built-in morphing swaps for DOM state preservation and an hx-partial tag for cleaner updates. Attribute inheritance is now explicit, with event names stan…

Google Chrome製のModern Web GuidanceをAI記者がコンテナで動かした。npxの1行で動き、APIキーは要らない。ガイドの検索と取得は1秒もかからずに終わった。ただし初期設定では検索の言葉がGoogleへ送られる。DISABLE_TELEMETRY=1を付けると送信は止まった。古い書き方の検出は、jQueryやXMLHttpRequestを見逃した。 コーディングエージェントにフロントエンドを書かせると、ひと昔前の書き方が混ざりやすい。jQuery風のDOM操作や、自前で作るモーダルなどだ。レビューする人は、MDNやCan I useを手で調べて今のWeb標準に直していく。Google Chromeのチームが公開したModern Web Guidanceは、この調べ物をエージェントとCLIに任せるための道具だ。エージェント向けのスキルと、コマンドラインの道具でできている。連載「AI記者が試した」では、AI記者が使い捨てのコンテナに道具を入れて実際に動かし、作者の主張を一つずつ確かめる。今回もコンテナの中で全47コマンドを実行した。コマンドの実行時間は合計33.0秒、最初から最後までは約3分（179.7秒）だった。作者は何と言っているかREADMEと記者の報告によると、作者の主張は次のとおり。インストールしなくても、npx modern-web-gu...

Les objets XMLHttpRequest (XHR) permettent d'interagir avec des serveurs. Vous pouvez récupérer des données à partir d'une URL sans avoir à rafraîchir complètement la page. Cela permet à une page web…

The read-only XMLHttpRequest.responseURL property returns the serialized URL of the response or the empty string if the URL is null. If the URL is returned, any URL fragm…

Curate Feeds | Make Collections | Customize Email Briefs

I want to provide a function that allows users to download cropped raster layer stored in GeoServer on client side. For this purpose, I used GeoServer WPS gs:download process. This is the code I'm using for downloading: let xhr = new XMLHttpRequest(); xhr.open('POST', 'http://localhost:8080/geoserver/ows?service=wps', true); xhr.setRequestHeader('Content-Type', 'text/xml'); xhr.onload = function() {}; xhr.send(xmlRequest); And this is the XML file I sent: gs:Download layerName saxony:dresden_dop outputFormat image/tiff RoiCRS EPSG:25833 ROI <![CDATA[POLYGON (( 401427.7604598588 5658195.9497047, 402604.46020956617 5658195.9497047, 402604.46020956617 5659343.11570035, 401427.7604598588 5659343.11570035, 401427.7604598588 5658195.9497047 ))]]> result It worked in the WPS Request Builder with the same XML file content. But it failed on the client side when I sent the request. I got the error: java.lang.IllegalArgumentException: Download Limits Exceeded. Unable to proceed! And no matter how small the cropped region is, I always get this error. I turned on the logging to developer, sent the request again and then got this logging messages: DEBUG [org.geoserver.wps.gs.download] - The underlying reader is not structured; returning native resolution DEBUG [org.geoserver.wps.gs.download] - Area to read in pixels: 1200000000 DEBUG [org.geoserver.wps.gs.download] - Area exceeds the limits DEBUG [org.geoserver.wps.gs.download] - Download failed It seems that the original file exceeds the limit but what I actually want to download is a small region of the original file. Is there any way to solve this question other than changing the corresponding parameter limit?

Release announcement, 2026-08-28.

Four Signals — The Wire

8개월간 개발한 htmx 4.0.0 이 출시됐으며, 2.x와 사용자 동작은 대체로 같지만 속성 상속·이벤트·히스토리 처리 방식이 달라짐 내부 요청 구현을 XMLHttpRequest 에서 fetch() 로 전환해 스트리밍 HTML과 새로운 확장 기능을 지원하며, 일...

One day, a user tried to do something simple: transfer a CSV file with 645,000 rows (`answers.csv`). But the browser console showed this: Access to XMLHttpRequest at '.../api/steps/24186/run' blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. POST .../run net::ERR_FAILED This looks like a classic CORS error. So you go and fix the origin setting in the backend, right? I didn't. Because the CORS config was already this: origins "*" Everything is allowed. So this could **not** be a real CORS problem. The header was missing because the server **crashed** before `rack-cors` could add it. The browser can't see that. It only sees "no CORS header in the response" and points you in the wrong direction. **Lesson 1:** If you see a CORS error while `origins "*"` is set, the problem is not CORS. The server can't respond. Go read the logs. ## The logs told the truth 08:55:29 heroku[web.1]: Error R14 (Memory quota exceeded) R14. Out of memory. The web dyno crashed while handling the `/run` request. But why would a "start the job" request use so much memory? ## Fake chunking The code split large CSVs into chunks of 10,000 rows. That sounds safe. But the chunking worked like this: file = read_csv_file(...) # loads ALL 645k rows into RAM file.drop(offset).take(chunk_size) # then takes 10k of them So every chunk loaded the **whole file** into memory before doing its work. The chunking never limited memory. It only sliced the data _after_ the full load. 645,000 `CSV::Row` objects means gigabytes. It was a false sense of safety. **Lesson 2:** "We chunk it" does not mean "memory is bounded." Look at the order — where does it load, and where does it slice? ## Layers, like an onion I thought I fixed the problem in one place, but it showed up in another. There were three separate full-load points: 1. **Worker read** — every chunk job parsed all 645k rows again. 2. **Web count** — `/run` needed to know the row count to plan the chunks... so it loaded the whole file again, just to call `.count`. 3. **Raw download** — at the very bottom, `read_as_utf8` downloaded the 183 MB file into a single String (plus one more copy if it needed re-encoding). I changed the first two to streaming: read row by row (`csv.shift`), count row by row (`each_csv_row`). Only one row in RAM at a time. To learn how many pages a book has, you don't put every page on the table. You turn them one by one and count. ## Don't fix without measuring After two pull requests, it was still on the edge. Instead of guessing, I measured — I ran the real production file on a one-off dyno: raw = 183 MB streaming count = 21.6 s peak RSS = 558 MB Here is the important number: 558 MB, even with streaming. Because the bottom layer, `read_as_utf8`, still pulled the full 183 MB into a String. The web dyno had 1 GB. A 558 MB spike + the app's base memory + other requests at the same time = too close to both the 1 GB limit and the 30-second router timeout. **Lesson 3:** Streaming removes the object pile (CSV::Table), but it does not remove the cost of downloading the raw data. You can't know which layer is expensive until you measure. ## The end: quick patch vs. real fix The user was blocked, so I was pragmatic: I resized the web dyno to Performance-M (2.5 GB). The transfer finished. But this is a patch, not a solution. The real fix is in the design: **don't do heavy work inside a web request.** Counting a 183 MB file synchronously is not the web dyno's job. The codebase already had the right pattern (another count endpoint did this off-request, with a Sidekiq job + Redis cache + polling). The `/run` path just wasn't using it. **Lesson 4:** If a user request takes 30 seconds, it is running in the wrong place. Put it on a queue, return right away, and let the client poll. ## Summary * `origins "*"` + a CORS error = the server is crashing, not CORS. * "Chunking" does not automatically mean "memory-safe." * Bugs come in layers; when you close one full-load, the next one appears. * Measure before you fix. I didn't know I was on the edge until I saw 558 MB. * Heavy work belongs in the background, not in a web request.