{
  "id": 16269863,
  "title": "When AI-generated HTML needs a backend",
  "url": "https://urgent.news/2026/10/24/when-ai-generated-html-needs-a-backend",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-24T03:20:45.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/plopino/when-ai-generated-html-needs-a-backend-4l9d"
  },
  "original_language": "en",
  "account": "When creating AI-generated HTML, it is essential to consider the backend requirements to ensure proper functionality and security. AI can quickly create polished HTML demos with buttons, calculations, forms, and even charts, making it seem like the entire application is published. However, this may not be the case, and there are key aspects to consider before deploying a static page.\n\nFirstly, it is crucial to determine where the data should go. Code can create a feedback form that looks finished, but the data remains in the browser's localStorage. This storage is suitable for drafts, preferences, or local-only tools but is not a shared submissions database. Browser storage might not be reliable for shared data after deployment.\n\nSecondly, consider whose computer \"localhost\" refers to. Code may call a fetch API with http://localhost:3000/api/quote, working on your machine during development. After publishing, the same code runs in the visitor's browser, meaning localhost now means their device. Replace the request with explicit sample data for a self-contained demo, or deploy an endpoint for live data, ensuring CORS policies are properly set up.\n\nThirdly, remove secrets from the delivered files. Privileged credentials are not automatically safe just because they are inside a JavaScript variable or an HTML comment. Inspect the actual export directory, checking for hidden secrets in source maps, generated configuration, fixtures, and comments. If a privileged API call is required, keep the credential on a server and have the browser call your limited endpoint, which validates the request and calls the upstream service.\n\nLastly, test browser boundaries and not just the layout. Local files, development servers, and public HTTPS pages have different environments. JavaScript modules loaded from file: URLs can trigger CORS errors. Ensure modules are delivered via an HTTP server with JavaScript-compatible MIME types. For public pages calling other origins, check the server's CORS policy and consider configuring origins or using server-side integrations for secure data handling.\n\nBy following these steps, you can ensure that your AI-generated HTML is ready for static hosting or requires a proper backend, providing a secure and functional user experience.",
  "summary": "AI disclosure: I used AI assistance to draft and edit this article. I reviewed the technical claims against the browser documentation linked below and checked the examples for consistency. The code is intentionally simplified. An AI assistant can produce a polished HTML demo in a minute. The page has buttons, calculations, a form, and maybe a chart. It looks like an application, so it is easy to…",
  "key_points": [
    "AI-generated HTML may lack backend functionality",
    "Data storage in localStorage unsuitable for shared data",
    "Secrets must be removed from delivered files"
  ],
  "editors_take": "Relying on AI for front-end code creates a false sense of completion that masks critical vulnerabilities in data persistence, security credentials, and server-side connectivity.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}