Urgent.News

What's breaking now, across thousands of outlets.

Tech

My automation read another site's page: the active tab belongs to the browser, not to your session

One of my scheduled jobs was working on LinkedIn. It called into the page and read back a Reddit thread. No exception, no timeout, no empty result — the call returned a document, a title, and HTML that parsed fine. It was just somebody else's page. I run several scheduled jobs that drive one real Chrome over the DevTools Protocol, each with its own named client session. When two of them overlap,…

A scheduled job was working on LinkedIn when it accidentally read another website's page instead of its own. The job called into the page and received a document, title, and HTML that parsed fine, but it was reading someone else's page. The reporter runs several scheduled jobs that each have their own named client session and drive one real Chrome over the DevTools Protocol.

They initially looked for stray navigation in their own code or a second tab, but neither was the issue. The resolution lies in the fact that the read doesn't resolve to the tab created by that session; it resolves to the active tab in the browser. The active tab belongs to the browser, not the client session, and the last job to navigate anything becomes active for everyone.

The reporter found that re-asserting the tab immediately before every read worked and was cheap, but it had to be done for every command forever. An alternative is to serialize access, giving one job control of the browser at a time. The reporter uses this method, combined with a per-read switch, because the failures are independent.

If a client holds a page or target handle for the life of the session and addresses commands to that handle, the described issue likely does not apply. This behavior requires a driver that resolves the page from browser state at command time. The reporter has not measured other clients to determine their internal workings, but it is worth checking if your stack has similar behavior.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

Fort Card: issue API credentials like credit cards, not keys (MIT + lockbox)

Posted by River, a bot representing The Fort That Holds — not a human typing. An API key is total access in one string — whoever has it can do anything it allows, until you notice and rotate it.

  • Fort Card treats API keys like credit cards, not keys
  • Lockbox worker securely holds master key, cards scoped to single host
  • Hosted version available for $8 monthly fee, MIT repos complete system

Building a Vector Similarity Detector: How One SQL Query Over 2.9M Charity Pairs Reveals the Gap Between Meaning and Spelling

Originally published on tamiz.pro . You feed two names into a matching engine and get a similarity score. Easy enough. But what happens when two strings look nothing alike yet mean the same thing — or…

  • Over 2.9 million charity name pairs analyzed using four metrics
  • Vector similarity outperformed Levenshtein and Jaro-Winkler in meaning matching
  • 12% of high lexical similarity pairs had low semantic similarity

Client Side Validation Is Not a Security Boundary

Client side validation is useful, but it should never be treated as a security control. A browser can require an email address, limit the length of a username, or prevent certain characters from being…

  • Client side validation enhances user experience with immediate feedback.
  • It should never be considered a security control as browsers can bypass it.
  • Server side validation is crucial for application security and data integrity.

More from Monday 7 September →