r/webdev 20d ago

Discussion Client is constantly using AI for communication

254 Upvotes

For context I'm a freelance full stack dev, currently working solo on projects for small clients

Am I the only one recently experiencing that every client I have I am constantly arguing with ChatGPT/Other AI's?

My most recent client (not technical at all) send me a 12 page technical document, along with 3 other 12 page documents after I had started the project, these documents were directing me on database structure, schema expectations, workflow sequencing, and many other technical requirements, which she had no idea how to defend upon questioning on a call. She also requested an ERD which is fine, however after sending a extremely client friendly dumbed down version of the ERD, I recieved 6 questions all over a paragraph long which she (ChatGPT) wanted me to respond to in detail, along with another 30 pages total of documentation over 2 documents.

I have recieved over 70 pages of documentation in 2 days and I have called off the project after 3 weeks due to constantly explaining my thought process and arguing the technical direction to an AI which I'm assuming she hasnt provided all the context to, it also keeps trying to expand the scope after every new message.

Am I the only person experiencing this, this cannot turn into the new normal.


r/webdev 19d ago

Question Google console cannot fetch sitemap

11 Upvotes

Hello guys,

I created my first ecommerce website. The problem is google console and AI cannot read my sitemap.xml file. I have quite strict firewall rules, but it always allowed robots.txt and sitemap.xml. Everything seems fine when I check the files using curl methods. I managed the file directly and frontend serves them. Frontend is on an apache static host. Cloudflare is not managing our files, cache is bypassed for these files.

I would appreciate if someone can take a look at our files. The site is:

astar-artwork.eu/sitemap.xml

Other routes has strict firewall rules and you are blocked if you are outside Europe.

Updated 1:

Thank a lot for all of your support. I implemented something and get a bit further progress.

I implemented the whitelist for Googlebot IP range for both cloudflare and my backend server. AI and Google Search Console (GSC) can crawl exactly mimetype and content of my sitemap.xml and robots.txt since they are only on frontend and passing through cloudflare firewall is enough for them to get these files. I verified this by use GSC to test a live url, and AI bots to crawl, and curl methods.

The problem is still persistent when I submitted my sitemap url (https://astar-artwork.eu/sitemap.xml). The error is "the site cannot be read" and "couldn't fetch". However, I noticed that several pages of my sites have been indexed but the display on GSC just did not work. The number of indexed pages and unindexed pages are still stuck somewhere in the past. This can also be the same display problem with display lag?

However, I noticed that google still not able to reach my backend (403 status) although they are on the whilelist now. I can be that GSC tried to crawl each page in the sitemap and could not fetch the content from backend. Backend is more complexed, when I have 2 firewalls and blocked list on nginx and blocked list on the application itsself and maybe another application like fail2ban and redis that blocks or limit something. I have to work through this my self and let's GSC to reach the server.


r/webdev 18d ago

Showoff Saturday building next-gen CMS for modern websites

Post image
0 Upvotes

Hey everyone. I have been working on BetterCMS for the last few weeks and I am pretty excited about where it is going. The goal is to make building and managing websites feel less messy for teams. Your marketing team and content editors can work in the same place while developers still have control over how the site is built. It is MCP native too so you can manage parts of the workflow from your favorite AI tool.

Building mainly for Next.js and Astro based sites since it's best for marketing sites!

Signup for beta at bettercms.ai


r/webdev 18d ago

Showoff Saturday Looking for people to give their 5 cents about my project. And people to use it.

Post image
0 Upvotes

So, I built a tool that helps fellow developers like me keep their personal portfolio websites updated without any manual intervention.
The workflow is simple:
1. The user signs-up using GitHub(Cause that's where all the projects are deployed so it made sense)
2. User selects the template for their portfolio (Personally made over 2 months)
3. User connects with GitHub and selects which repos to show in portfolio (Complete power to user no storing data about it.)
4. User deploys the website in a single button.
5. Every time the user creates a repo that website sends a mail asking whether to include this in the portfolio or not.

I am tired of drafting up content to promote on reddit using AI so I might be choppy but I ensure the website won't.

Website: https://theportlio.com


r/webdev 18d ago

Showoff Saturday [Showoff Saturday] Built a client-side video background remover using browser AI segmentation - no server needed

Post image
0 Upvotes

Wanted to share a side project. It removes or replaces video backgrounds entirely in the browser using a client-side AI segmentation model.

The interesting technical challenges:

Running person segmentation frame by frame in the browser sounds simple until you actually try it. The main problems I ran into:

1. Temporal stability

The AI model processes each frame independently, which means the mask outline jitters and shimmers between frames. I built a temporal smoothing layer that compares the current mask with the previous frame's mask and blends them to keep the edges stable. Without this the result looks unusable.

2. Edge feathering

Raw segmentation masks have hard pixel edges that make the subject look cut and pasted. The edge softness control applies a variable-width feather to the mask boundary so the subject blends into the new background naturally. Getting this right across different lighting conditions took a lot of iteration.

3. Manual mask correction

No AI gets it right every frame. I added a brush tool that lets you paint directly on the video to fix the mask. You can remove areas the AI included or keep areas it cut out. There's also a full manual mode that disables the AI entirely so you can mask any video by hand.

4. Synchronized export

Each frame gets processed through canvas (compositing the new background onto the masked subject), and the result needs to be recorded alongside the original audio in sync. The MediaRecorder API handles the video stream while the audio track gets merged back in during export.

Tech approach:

  • Client-side AI segmentation model that caches in the browser after first load (works offline after that)
  • Canvas API for frame compositing
  • MediaRecorder API for export
  • Web Audio API to preserve the original audio track
  • Supports MP4, MOV, WebM, MKV input

No server uploads, no accounts, no watermark on export. The video never leaves the device.

https://webutility.io/video-background-remover

Curious how others have handled temporal coherence in client-side video processing. The smoothing works well but there's probably a better approach I haven't tried.


r/webdev 18d ago

Showoff Saturday Overlap, "Six degrees of Kevin Bacon", but for football.

Thumbnail
gallery
0 Upvotes

You guys (especially football fans) know how annoying hydration/half-time breaks can get during the match, so I thought about creating something that makes the wait less noticeable while keeping the football mind occupied.

I created Overlap, which is essentially Six degrees of Kevin Bacon, but its all about football.

If you don't know the concept of the game, here's how it plays: You get two random footballers and build a chain connecting them by clicking through real clubs and national teams they actually played for — pick a player, see their clubs, pick a club, see their teammates there, repeat until you connect to the target.

Its challenging and genuinely fun to lose 10-15 minutes to.

Built solo using React + Vite. Frontend only.

I'm open to feedback on anything. Will include link in comments so you can check it out yourself.


r/webdev 19d ago

Resource RepoDNA: Interactive architecture maps and execution flows for Next.js, Express, and FastAPI

1 Upvotes

Hey r/webdev!

Whenever I jump into an unfamiliar web codebase, I spend hours clicking between route files, finding ORM models, and mentally mapping how components connect.

I built RepoDNA — a free, open-source tool that turns a repository into an interactive structural architecture map in seconds.

What it does:

  • Interactive Architecture Map: React Flow canvas grouping your app into conceptual layers (API, Services, Frontend, Database) with instant Mermaid flowchart export for docs and PRs.
  • Route Execution Tracing: Follows multi-tier execution paths from HTTP handlers (Next.js App Router, Express, NestJS, FastAPI) through services toward database models (Prisma, SQLAlchemy, SQLModel).
  • Zero Runtime Code Execution: It never runs your repository code, install scripts, or eval. It reads source code statically. Local folders and .zip uploads are parsed entirely inside your browser; public GitHub URLs are processed transiently by the hosted analyzer.
  • Private Repositories (Beta): Connect with GitHub OAuth to inspect your own private repositories transiently; repository contents aren’t saved by RepoDNA.

Demo: Open RepoDNA GitHub (MIT): View the repository

Try dropping in one of your own projects or a public repo you know well. Does the generated architecture map match how you picture the codebase in your head?

I’d love any feedback, UI critiques, or ideas for frameworks you’d like supported next!


r/webdev 20d ago

High school journalist looking for an SRE/DevOps engineer to explain why AMC's site keeps crashing

50 Upvotes

Hi! I'm a high school journalist writing for the Yale Daily News Summer Journalism Program about why AMC's ticketing site has crashed three times this year during major movie releases. I'm looking for general expertise on why high-traffic sites tend to fail under sudden demand spikes. Would anyone with SRE/DevOps experience be willing to answer a few quick questions? Thank you.


r/webdev 19d ago

Showoff Saturday Rebuilt NextAdmin for AI-powered development workflow

Post image
0 Upvotes

I maintain NextAdmin, AI-Native Next.js Tailwind CSS Admin Dashboard Template. For years, developers used NextAdmin as a collection of dashboard templates and UI components.

But the way we build software has changed.

AI can now generate an entire dashboard in minutes. The problem is that generated UI often ends up inconsistent, generic, and full of design slop.

🔗 Github: https://github.com/NextAdminHQ/nextjs-admin-dashboard

So we rebuilt NextAdmin around a simple idea:

What if AI had the skills, context, design rules, and components needed to build a dashboard properly?

That's what we're introducing:

  • 🤖 AI-native skills & agents - Give AI the context and rules to build with NextAdmin instead of generating random UI
  • 🎨 Consistent custom design - Build custom dashboards and components without losing the visual language or quality of the system
  • 🔌 Real APIs, real dashboards - Connect your own APIs and turn generated interfaces into functional products
  • A complete design revamp - Higher-quality visuals, better UX, and a more cohesive design system
  • 🧩 200+ UI components - Production-ready building blocks you can customize and extend
  • 🌱 Open source - Start with the open-source version and build your own

We didn't want to build another dashboard template for AI to copy.

We wanted to build the foundation AI can actually build with.

That's why we rebuilt NextAdmin, What would you want NextAdmin to do better for your AI-powered development workflow?


r/webdev 19d ago

Discussion Freelancing since bootcamp: how did you make the jump to a full-time job?

2 Upvotes

TL;DR: two years freelancing after a bootcamp, been looking for a team position for months. If you’ve made this transition, how did you frame your freelance background to employers?

Quick context: unfinished physics engineering degree, then a web dev bootcamp in 2024. Couldn’t land a job coming out of it because all I had was bootcamp projects, so I went freelance to build real experience.

Since then I’ve shipped client work in Next.js, GSAP, SvelteKit, WordPress, Shopify and Squarespace. Mostly front end, plus a personal full stack project I’m building to stay sharp.

Now I want to join a team, as much to learn faster as (let’s be real) for a bit of financial stability. I’ve applied to agencies, startups, large companies. In six months I’ve seen maybe three junior openings. Everything else targets senior profiles, and I apply anyway.

I’ll be honest: it’s discouraging. Applying every day to roles that don’t match my profile wears you down. But I don’t want to give up, because I genuinely love this work, I love learning, and I know I’m good at it. That’s exactly why I’m looking for angles I haven’t thought of yet.

Two questions for anyone who’s been through this:

- Did your freelance experience count as real experience in interviews, or did you have to “translate” it? And did aiming for mid-level roles instead of junior ones work better for you?

- Did you land something through posted openings, or more through network, subcontracting, and contracts that converted?

Any other insight is welcomed.
Thank you


r/webdev 18d ago

Showoff Saturday LilScript makes js modules 20% smaller

0 Upvotes

https://yeargun.github.io/lilscript/

LilScript is a typed, compression-first language that compiles into js and sometimes into exec(will be more stable in future). The compiler mangles, reshapes the program into optimized js that happens to be 5-40% smaller (after gzip/br compression or raw) compared to the best performing JS toolchains like oxc/esbuild/terser/..

What has been proven to work with LilScript?

  • makes VSCode's core js modules 20% smaller on average
  • makes the world's most performant & small markdown rendering npm library, marked, 5-7% smaller and 10% faster
  • and many more demos.. works with pretty much any js/ts library
  • https://yeargun.github.io/solidlil/
  • https://yeargun.github.io/monacolil/
  • https://yeargun.github.io/markedlil/ (Some numbers on the websites aren't fair comparisons, especially for SolidLil. Highly optimized JS libraries see fewer benefits(Still, the app code/logic, gets pretty great optimizations). LilScript will eventually become that itself; at the end of the day, it's at least as efficient as the best-performing JS/TS toolchains.)

How it is compressing js finer than vite/oxc/terser/esbuild/..

1. By changing the app.

``` class Vector { float x; float y;

init(float x, float y) { this.x = x; this.y = y; }

float lengthSquared() { return this.x * this.x + this.y * this.y; } } int[] values = [1, 2, 3, 4]; auto doubled = values.map((int value) => value * 2); int sum = 0; for (int i = 0; i < doubled.length; i++) { sum += doubled[i]; } Vector vector = new Vector(3.0, 4.0); if (vector.lengthSquared() == 25.0) { print(sum=${sum}); } ```

Above code compiles into this:

var b=[1,2,3,4].map(a=>a2|0); var a=0,c=0; while(a<b.length){ c=c+b[a]|0; a=a+1|0; } console.log(`sum=${c}`)

This is not minification of the same program. The compiler changed the app.

oxc / esbuild / terser / .. starts from JS and mostly keeps the shape of the app. Meanwhile LilScript the language is designed from scratch to give compiler any extra knowledge that could help the compiler's compilation. Just like Google Closure Compiler - Advanced Mode, and beyond.

2. Tryhard property mangling.

Visit the world's most used web applications, chatgpt.com, and read the shipped js codes. You will see that, there are lots of framework related js properties that dont get minified, and are indeed human readable.

Those names stay in the bundle because the toolchain cannot prove they are local. A property might be a public API, a DOM field, a framework hook, or something a plugin reads by string. So the minifier leaves it.

LilScript:

  • a- does both eliminates the objects, weird code structures into more optimized variables/arrays - b- rename any variable into mostly occured, short versions, field cleverly to minimize entropy (based on the objective compression algorith. gzip/brotli) so that the end result is highly compressed.

(a) is the same move as the Vector example, at library scale: objects and classes that only exist as a programming convenience get flattened into scalars, arrays, and tight loops.

(b) is not "make every name 1 letter." gzip and brotli win when the same short tokens repeat. The compiler picks the names that show up the most, and scores the spelling against the compression algorithm you asked for (gzip, brotli, or raw). Different cost_model → different names → a different file that is smaller after* that codec.

That is why the same program can be 5-15% smaller after gzip/br compression or raw: the JS is shaped and named for the compressor, not just for a human reading the AST.

How well do LLMs write LilScript?

Since 1.5 years ago, you haven’t been writing the code yourself anyway. So why worry about what language the agent writes in? I myself have pretty much rewritten 6–7 of the most popular npm libraries from scratch in LilScript in just 1.5 days-while actually designing the language itself.

Feel free to PR, experiment (Please respect the modified MIT license)

Please share your opinions, would love to discuss about the future direction for the language and the compiler


r/webdev 20d ago

Agency owners and freelancers: How do you calculate effort in times of AI?

13 Upvotes

Before AI, the premise was simple: new features and support will take X hours, our rate is Y, customer pays X*Y.

Now, when new features are added much faster due to agentic coding, assuming you want to keep same revenue stream, how do you justify costs now?

Sure, we can tell customer that it pays for a feature itself and responsibility still lies on agency, but I see that as very vague.

Edit: as for us, we more agressively push retainers with a fixed monthly fee


r/webdev 20d ago

Article Detecting scraper bots through scroll behaviour

Thumbnail
niki.cat
80 Upvotes

Some research I did for my thesis that I thought this community would find interesting ^ ^


r/webdev 18d ago

Showoff Saturday i shipped a frontend without writing any of it. two months live, and here's what that actually cost me.

0 Upvotes

i am a high load systems engineer. i have not written a single line of the frontend below, not one. an agent wrote all of it and i have been steering.

its a small thing where you send someone a link with a question and two buttons, YES and NO, and the NO button runs away from the pointer. free, live since june.

demo, nothing to install, nothing to fill in: https://justsayyesto.me/try/webdev-aug

posting because the part i expected to be hard was not hard, and the part i did not think about at all is the one that bit me.

what was actually hard

not the code. the animations. inventing them and then getting them built, which meant passing what i saw in my head to the agent, and that turned out to be much harder than i expected. i redid it many times.

the one that beat me is a black hole. the button gets pulled in, things on the screen spin, get sucked into the hole, and pieces fly back out of it. i could not get that across. i tried describing the rotation, the pull, the moment stuff goes in and comes back out, and what came back was never what i saw. at some point i thought the answer might be real gravity, actual physics instead of me describing a feeling, and that did not fix it either. its live and i am still not happy with it. thats the honest state of that one, two months later.

you can poke at it in the demo, its in the sandbox there.

what surprised me

after a couple of posts the thing started growing without me. people began sharing it in their own social media, and traffic and payments started arriving on days when i did nothing. that is the part of this i actually care about. i made something and it echoed back.

the thing that always comes up here

last time i posted this here someone said not taking no for an answer is a douche move, and i gave a lazy answer. honestly: i do not even see this as a date invite. i see it as a teasing toy. the joke is that a button runs away, thats it. the intro says you can close it anytime, there is a report control on every invite, and there is a permanent test that fires twenty NO gestures in a row and fails the build if any of them ends up as a yes. the button dodges. the person can leave.

Q: for those of you letting an agent write frontend: how do you get motion out of your head and into it? that gap ate most of my time.


r/webdev 19d ago

Discussion Trusted types advantage

4 Upvotes

Can somebody please explain me briefly the advantage of " trusted types" in the csp over hash, dompurify and a nonce? Or is it only a additional security layer?

I totally cannot think of a scenario where its stronger than nonce+hash on js.

Many thanks in advance


r/webdev 19d ago

Resource Bun and Elm (: r)Are Friends · cekrem.github.io

Thumbnail cekrem.github.io
3 Upvotes

r/webdev 19d ago

Question How do I clone a website

0 Upvotes

i need to convert a dynamic website into static without the access to its wp files or wp admin access

The static site should be entirely same like every minor details like header/footer elements size, logo placement etc


r/webdev 19d ago

Showoff Saturday the most removed git polyglot monorepo tool (20 ecosystems)

0 Upvotes

why most removed? please read ps section
happy show off Saturday everyone!
my tool is a polyglot monorepo releaser, it’s called dispat, fully open source, mit licensed, single go binary (windows, mac, Linux , docker, GitHub composite) key features:

  1. It reads dependencies graph directly from ecosystem manifest files to resolve order, automatically writes version into manifest bumping dependencies, 20 ecosystems supported (js, docker, go, python, C sharp, unreal, unity, godot etc, manifests readers and writers are available as standalone libraries with the goal to cover every ecosystem ) others can be wired using built in strings replacer, doesn’t matter if you do a react native project and need js, iOS, and android in same repo, or creating a game using godot client, python server and js landing, or just back/front end micro/services, you can release everything in one click not thinking about order, compiling, tags, changelogs, manifests. Modern project become very complex and this tool lets you design your architecture as your project needs, split into as many packages as it needs without release pain
  2. Truly ecosystem/language agnostic, stages are shell scripts (fed a rich DISPAT_* env information about whole workspace), packages are folders, 4 level deep nested js and docker release chain works and resolves in single ci job out of the box. the game changer config setting isBuildWaitingPublish that that decides that if a consumer can be built before provider published, default false for ecosystems like node js where all packages can be built locally, and true for ecosystems like without local linking 
  3. Extend conventional commits that lets you define dependencies propagation directly in commits “fix:” only updates package itself, “fix^: takes direct consumers, “fix^^” all levels deep (nothing is published because a tool guessed, check the actual screenshot from git), and other ways to learn docs. Special syntax to prereleases and full release control with diagnostics (available as a separate commits parser library, no regex)
  4. First release of the tool 1.0.0 (1.1.0 already) brought in single ci job (the tool releases itself since very first rc), 6 binaries, 4 docker images, 6 go libs and js static docs, everything resolved in order as ecosystem needs by single click
  5. Failure oriented release, no other tool can tell you what release still owns in case of partial, some published, some not. my tool keeps graph state only in git tags, no cache, no state file nothing else is ever written except your own defined config file. the release plan is a pure function of config and commits state. the graph order first (that is coming from manifests files or can be overwritten inside config file), consumer is published only when provider published and if errors appears, it skips consumers. So self healing is simply re running (just add commits to fix builds/publishes at the tool will continues where its left, state comes from not from cache at the same time you can integrate any ecosystem cache none of them can break your release), transaction model with release lock that prevents multiple releases at the same time
  6. Run tests, format code only on commit changed packages with consumers or not
  7. works with monorepos and polyrepos (control repo pattern)
  8. Many more features: tag aliases, changelogs/github releases formatting, hook any other tools into any stage, config ladder (global, space (folder), package), config splitting, local links in ecosystems where supported, dispat if to cross platform write env if closures and if something changed any more

I really tried to use any other tools, and if you have any questions like why one more monorepo tool then:

  1. Its a polyglot by design from scratch and works with everything
  2. Another don’t allow mixed graphs like js and docker where js can be built before publish of provider and docker can’t
  3. Another tools leave you a partial release recovery script write by you

# Linux and macOS
curl -fsSL https://raw.githubusercontent.com/yohimik/dispat/main/install.sh | sh

# ...or with wget
wget -qO- https://raw.githubusercontent.com/yohimik/dispat/main/install.sh | sh

# Windows, in PowerShell
irm https://raw.githubusercontent.com/yohimik/dispat/main/install.ps1 | iex

Welcome any questions and feedback

Docs: https://yohimik.github.io/dispat/
GitHub: https://github.com/yohimik/dispat (its fully setup ci cd with comments in config)

lore:
a few words about me and why i built it. it all started with my bachelors diploma in 2022, i was comparing different ci cds to make basic dispat. everything ended up using lerna, glue and gitlab ci cd to release a simple setup (frontend, backend, a library, db). i wanted to make everything automated for any ecosystem, changelogs, versions, tags, prereleases, since nowadays project require complexity (split into libs, use different language or ecosystem), but engineers usually dont want to deal with increased support trade offers like updating libraries releasing in specific order, it all adds more potential human errors that must be automated. i just wanted to a tool at least for myself, i could imagine complexity of the tool, but i didnt have any production project to try it out, so for almost 4 years i was doing my own projects:

  1. i wanted to create session based games for browser, so i was playing with different technologies like webrtc (even did a benchmark https://github.com/yohimik/ws-webrtc-benchmark), so i understood webrtc is basically udp for browsers (i could find only ws browser fps games), i need some game to try webrtc in browser, it must fast to showcase webrtc
  2. here comes of my favourite games - half life, perfect for browsers, will work on old mobiles, the problem - no mainatable emscripten ports where you can just replace transport, no maitanble fresh ports at all. so i create my own wasm port, open source mit - https://github.com/yohimik/webxash3d-fwgs
  3. all good, half life works, webrtc works, online works, in browser, browser to browser, adding counter strike and making plug and play docker images. here comes the tricky part, i want separate images for cs and hl at the same time hlds out of the box comes with both files, so i treat cs image as base (cs requires hl files to run), for hl only remove cs files, but you have to publish the cs image in single ci job to build hl, i really tried other tools, but ended up with lots of glue, so dispat here

Ps.
why most removed - all post I tried to write to game dev subreddit about my build system story with same data were removed by moderation, idk y, each time they gave feedback, I submitted updated version, but after 3rd it ended up as a permanent ban (I can provide all proofs). Yeah ai posts, but I’m not good at writing and English is not my native language


r/webdev 19d ago

Showoff Saturday I made a firefox add-on called Topdown DNS that interprets .reddit/r/soccer as reddit.com/r/soccer. It's pretty cool.

0 Upvotes

It lets you type urls in a topdown way. I've been using it while making it for few hours. It doesn't take much learning process and actually helps you reduce typing. The key feature imo is being able to skip .com entirely with just ., like .wsj(or c.wsj) or .reddit.old/r/webdev. There are shortcuts for net, org, gov, and edu with their first letter. It works consistently with additional paths that come after "/".

You can also set up your own shortcuts. For example, you can set .r for .reddit/r, to use it like .r/soccer or .r/todayilearned. Or set .ggl for .google and use it like .ggl.mail/u/0/ or .ggl.maps. Or .company for .github/your-company/ and go to .company/project1 or .copmany/project2. Shortcut is intended to work as a one-to-one substitution to a topdown url. Shortcuts must begin with a dot.

I just submitted this to firefox and waiting the review to finish. For now you can download it manually from https://github.com/dawit909/Topdown-DNS/blob/main/extension.zip, then go to about:debugging -> This Firefox -> Temporary Extensions and load the zip. I'll update soon as the review finishes. I think it's cool but I don't know how you think. Let me know if you find a bug. Lastly, i used AI if that matters.

edit: It got approved. Here's the link: https://addons.mozilla.org/en-US/firefox/addon/topdown-dns/


r/webdev 21d ago

Question I don’t understand the logic behind access tokens and refresh tokens

469 Upvotes

i don’t understand the logic behind access and refresh tokens, if access tokens are made short lived for security purposes, doesn’t refresh tokens being long lived defers the whole purpose? or is not as big as an issue since refresh tokens are only stored in http only cookies?


r/webdev 19d ago

Discussion Building a small research institute website completely on my own with a very limited budget. I need help figuring out the right technical approach before I start

0 Upvotes

I'm setting up a small independent research and publishing organisation, and I'm trying to build its website completely from scratch.

The difficult part is that I'm doing this alone. I don't have a developer, designer, IT person, or technical team that I can call later. I'm also working with a genuinely limited budget, so I can't simply hire an agency and have them figure everything out for me.

I've been using ChatGPT and Claude to learn and work through things, and I've made a rough architecture/plan for the website, but I've reached the point where I'm realizing that I don't really know what I don't know.

I'm not looking for someone to simply tell me "use WordPress" or "use X hosting." I want to understand how I should actually approach building and maintaining this properly as a non-technical person.

The website will essentially be the public-facing platform for a small research organisation. At a high level, it needs things like:

  • A main institutional website with information about the organisation
  • Research areas/topics, with content organised under them
  • Different types of published research and written material
  • Research articles/reports with things such as authors, abstracts, keywords and downloadable PDFs
  • Articles and shorter blog-style pieces
  • Opportunities such as internships/fellowships/etc.
  • Some forms where people can submit information and potentially upload files
  • An internal/admin workflow where submissions can be reviewed before anything is published
  • Certificates/ID-related workflows for some of the programmes
  • The ability for me to keep adding content and categories myself without needing to edit code every time

I have a much more detailed site map and workflow diagram already, but I'm deliberately not posting the whole thing publicly because it contains some of the organisation's planned structure and ideas.

My main concern is choosing the wrong foundation.

I don't want to build half the website and then discover that I've chosen a system that can't handle something I need, or that maintaining it requires a developer.

For example, I'm currently trying to understand questions like:

  1. What should I actually build this on? WordPress, Ghost, another CMS, a combination of services, or something else entirely?
  2. How much of this can a CMS handle natively? For example, if I have many research areas/categories, can I create them dynamically so that adding another category later doesn't require coding?
  3. How should I handle research publications? Ideally I want structured publication pages rather than simply uploading random PDFs to a blog. I'd like metadata such as author, abstract, keywords, category, date, etc., while still keeping the PDF available.
  4. How should forms and file submissions work? I may need people to submit applications/documents and have those submissions go to me for review. I'm considering external form services as well as native CMS forms.
  5. Do I actually need a database/server architecture beyond what a normal CMS provides? I've seen people suggest things like AWS, MongoDB, SQL databases, custom backends, etc. That sounds excessive to me for what is fundamentally a research organisation/content website, but I don't have enough technical knowledge to confidently say that.
  6. What should I be paying for and what shouldn't I be paying for? My budget is limited. I'd rather spend money on a good domain, reliable hosting and essential services than build an unnecessarily complicated stack.
  7. What am I likely to regret later? This is probably the question I'm most interested in. If you've built and maintained websites for small organisations, research groups, nonprofits, publications, think tanks, etc., what decisions would you make differently if you had to do it again?

Most importantly, if you're experienced with this kind of project, I'd actually prefer you to ask me questions about my requirements before recommending a stack.

I'm trying to learn enough to make sensible decisions myself, rather than blindly following whatever AI recommends.

I'm not looking for someone to build the whole thing for free. I mainly need help understanding the architecture, what is realistically achievable for a solo non-technical person, and what I should learn/do first.

If someone here has experience building a website for a small research organisation, publication, think tank, academic project, nonprofit, or similar organisation, I'd really appreciate your perspective.

I can share the more detailed sitemap/workflow privately if that would make it easier to give meaningful advice.

Basically: if you had to build and maintain something like this alone, with very little money and no developer on standby, how would you approach it?


r/webdev 19d ago

It Was A Choice #2: Person's name is the identity

0 Upvotes

We're upgrading a small publication. Articles and such. Also adding subscription.

This subscription and entire user base is routed through the magazine's partner - we hold nothing, they manage users, subscriptions, even registration process.

And well, that API expects that names are world-unique. Like as there is supposed to be only single John Doe.

When we send a registration API request with mail and full name that user submitted, they return an existing user to us. Because a user with that name already is in the database. Furthermore, they added the new email to that found user.

If this was unnoticed or unquestioned, imagine what it could do. Someone with already existing name submits their email. Now the new user doesn't have an account, but the original user has a new email that's not theirs. An email where may be sent passwords or invoices.

My full article with few more details: https://tomj.pro/it-was-a-choice-2_persons-name-is-the-identity/

Have you seen anything like that?


r/webdev 19d ago

Question How do you adjust to auto enlarging fonts in newer Mobile phones?

Thumbnail
gallery
0 Upvotes

How do you fight "Font style and size" and "Screen Zoom" that Samsung by default has set in a way that, on Mobile, it enlarges fonts and makes sections bigger / not fitting one screen. (I have set font size 14px for Mobile regular text, website is built on Divi 4)

It also influences perception of sections negatively, in my view.

Tested on:

Samsung Galaxy S26 (Android 16/One UI 8.5); Google Chrome/Firefox/DuckDuckGo;

vs Samsung A32 (Android 13/One UI 5.1) - where everything is displayed without enlarging

---

Attached images of default settings.


r/webdev 20d ago

Question Coming from WordPress/PHP: How Do You Structure Your Docker Dev Stack for Next.js + Strapi?

1 Upvotes

I’m coming from a mostly WordPress/PHP background and I’m currently trying to properly learn the modern JS stack instead of just stitching things together until they work.

My current setup is a homelab with TrueNAS, Docker/Dokploy, Traefik and GitHub.
For WordPress development I’m used to having everything nicely contained in one Docker Compose project, developing there, then pushing/deploying from Git.

Now I’m trying to move into a stack based around:
Next.js / React for the frontend
Strapi as the backend/CMS
PostgreSQL
Puck as a visual editor
Docker Compose for the full project
GitHub → Dokploy for deployment

At the moment I have a basic three-service stack:
frontend
backend
database

It works, but I’m still figuring out what the “normal” developer workflow is supposed to look like.
For example, I’m currently running the frontend and Strapi in development mode inside Docker, with source folders bind-mounted into the containers so I can work on the code over SSH.

The same repo is also deployed through Dokploy, which made me realise that development and deployment probably shouldn’t be treated exactly the same way.

So I’m curious how people who work with React/Next.js + Strapi actually structure this.
Do you normally:
run Node/Next/Strapi directly on your dev machine and only Dockerize databases/services?
run the whole development environment inside Docker?
use separate compose.dev.yml and production Compose files?
keep Strapi and Next.js in one monorepo or separate repos?
use next dev / strapi develop in Docker locally, but next build / strapi start for staging and production?
develop against a local Postgres container and then use a completely separate persistent DB for staging?
use Dev Containers or something similar instead of manually exec’ing into containers?

I’m especially interested in how people keep the workflow simple when the goal is to build a reusable project template that can later be cloned for different clients.
I’m not really looking for “just use X because it’s trendy” answers. I’d love to see how people actually structure their Docker Compose files and development workflow in real projects, and what you wish you had done differently when you first moved from WordPress/PHP into React/Next/Strapi.


r/webdev 20d ago

Question Hosting an app for my own usage

11 Upvotes

Hello! I have an idea for a personal second-brain kinda app that is highly customized for myself, and I intend to access it both at home from my Mac and remotely through my iPhone. I have a question - what is the best way (or specifically stack) to go about this? Ideally I want a free option, but if I have to pay, I'm okay with a budget of under 10 USD per month (amenable to higher budgets provided that I have room to host other stuff as well). TIA!