browser-base | Modern and feature-rich web browser base based on Electron | Browser Plugin library

I am looking into a way to properly implement refresh & access tokens on a simple SPA with Dotnet Core Backend. The more I read about it the more I seem to worry about its impact on server performance especially as the number of logged in users grows.

Take this auth0 post and this specification for example it clearly demonstrates that we need to create a new refresh token every time we create an access token, due to Malicious Client attempting to reuse Refresh Token.

In particular, authorization servers: MUST rotate refresh tokens on each use, in order to be able to detect a stolen refresh token if one is replayed (described in [oauth-security-topics] section 4.12)

Now given that we want to keep the Access token expiry time limited (e.g. 10-20 minutes) and we need to persist every refresh token which we generate in order to recognize malicious activity of old refresh token being reused.

Which means that every 20 minutes n users hit our backend to refresh Access token and create a new refresh token, so for 1k logged in users that`s 1k requests every 20 minutes, also for each of those users our api checks if refresh token they have presented has been already invalidated, if not, we persist the new refresh token.

Hence after a day of user being logged in, we saved: 24 * 60 / 20 = 72 different refresh tokens .. and now we check every user against every single one ??

Am I missing something, how is this scalable?

I am trying to create a pop-up dialog in my browser-based Qt/QML application in order to select a file on my workstation to upload to the unit running the web server. I am unsure what "context" the FileDialog is operating in when invoked via button click in the browser. Is it local to the unit that's running the server and hosting the page or is it local to the workstation running the browser?

I've got the following code in QML, taken from an example in the FileDialog documentation:

CONTEXT: We have a platform where users can create their own projects - multiple projects per user. We need to provide them with a browser-based IDE to edit those projects. We decided to go with coder-server. For this we need to configure an auto-scalable cluster on AWS. When the user clicks "Edit Project" we will bring up a new container each time. https://hub.docker.com/r/codercom/code-server

QUESTION: How to pass parameters from the url query (my-site.com/edit?project=1234) into a startup script to pre-configure the workspace in a docker container when it starts?

Let's say the stack is AWS + ECS + Fargate. We could use kubernetes instead of ECS if it helps.

I don't have any experience in cluster configuration. Will appreciate any help or at least a direction where to dig further.

I have made a app: Dash is used to make the browser-based gui and the backend calculation is made in purely Python3.

Since the calculation can take from seconds to hours or even days depending on the user's study case, I used the decorator of long_callback from Dash. The GUI follows simple user logic:

1. When the run button is clicked, the button is disabled to not only inform the user that the app is doing the calculation, but also prevent the user from clicking the button again when the app is still doing the calculation.
2. When the app is still doing the calculation, the user should be able to use other parts of the app, just except the run-button. And the on-going calculation in the backend should not be influenced.

I have made a simplified code to demonstrate my issue.

1. First, I enter an arbitrary value, e.g. 10 in the entry.
2. Then, I click the run-button. The button is disabled and the app runs like expected.
3. Before the run finishes (i.e. before the run-button becomes enabled), I changed the entry from 10 to 20, the output message shows the number 20 instead of 10. How is it possible? After clicking the run-button, any further operation on the GUI should not influence the call that is already started. Could you please show me how to implement it? Thanks.

I am trying to loop through these objects and want to make a common component so that I can call import any pages and use the same.

Array of objects: `

I'm doing browser-based uploads to my S3 bucket and of course, when doing it that way, there's nothing to stop an end-user from uploading any file of any arbitrary size.

Is there a way to modify the bucket policy to prevent abuse of this kind?

This is my current bucket policy:

I am using vim on a browser-based RDP session. Unfortunately, my browser is realllllly particular about capturing the "ctrl-w" key combo, because of unrelated-to-my-specific-use-case security reasons. This prevents me from using the pane feature of vim, because when I try to switch panes, my tab closes (!!!). Is there a way to change the "pane switch" hotkey to something besides "ctrl-w" in vim?

I am writing a browser-based javascript to scrape the input value by user and provide feedback. And in the page, you have to click on different areas for the desired element to show. I am trying to see if there is a way I can get javascript to wait until the element returns before I start going to the next one. Right now I just use setTimeout, but I have to loop all the elements I want to get, so nasty nested functions. trying to see if there is a more elegant solution. I used to write VBA, so I am not so familiar with async web API. still learning

I followed Apple's official example (https://developer.apple.com/documentation/uikit/view_controllers/building_a_document_browser-based_app#overview) and tried to revise it to display a PDF viewer.

I modified the original sample code to create the following code. It works totally fine with any simulators on my Macbook Pro (2020). However, when I tested with iPads (i.e., iPad Mini & iPad Pro: new generations), I cannot open PDF files.

I identified that the following code is not working: let doc = PDFDocument(url: documentURL). The URL seems to be appropriately obtained. doc remains to be nil when testing with iPads, while appropriately obtained when testing with simulators.

I would really appreciate it if you could let me know what is wrong with my code.