4 posts tagged with "frontend"

Most captcha integrations get bolted onto a login form, annoy every real user forever, and stop the attacker they were meant to stop for about as long as it takes someone to point an AI model at the image.

gts-meghni/laravel-captcha is built around that fact instead of ignoring it. It ships two separate defences that stop two different kinds of attacker, and it expects you to run the invisible one everywhere and the visible one only when a caller has earned it.

This post is in two halves. Part one is the backend, from installing the package to deciding when an image gets demanded. Part two is the frontend, in React, Next.js and Inertia. The two are joined by a small JSON contract, written out at the end of part one, so you can build either side on its own and read only the half you need.

At some point in almost every React + Vite project, someone drops the backend URL into a VITE_API_URL env var and moves on. It works, the demo passes, nobody thinks about it again. Then a few months later you're staring at your own production bundle in DevTools and your internal API host is sitting right there in plain text for anyone to read.

There's a cleaner way to do this, and it's the approach we standardize on. The frontend only ever calls same-origin relative paths under a single prefix: /api. The real backend, storage, and WebSocket hosts stay in a proxy layer (Vite's dev server while you're developing, nginx or Caddy or a CDN in production) and never make it into the JS that ships to the browser. This post walks through how to set that up and the mistakes to watch for.

For developers at Sadeem Informatique

Most developers know what the codes mean — very few consistently use them correctly in real applications. This guide shows practical usage patterns you will actually encounter in production React/Next.js apps + Node.js/Express/Laravel/whatever backend.

Photo by ThisIsEngineering on Unsplash

For developers at Sadeem informatique

Most articles explain where to store tokens. This guide shows you exactly how to implement a secure setup in a real web application.

We'll build the modern recommended pattern:

This approach aligns with OWASP security guidance and is widely used in production SaaS applications.

Photo by Dan Nelson on Pexels.