Topic
208 posts tagged “Web Development”.
Takina · · 4 min read Abstract classes in TypeScript define shared implementation plus methods subclasses must fill in. How they differ from interfaces and when to reach for them.
Takina · · 4 min read The Beacon API lets a page send one last async request as it unloads, without blocking navigation or racing the browser's page teardown.
Takina · · 4 min read A lockfile records the exact dependency versions your package manager resolved, so every install — from your laptop to CI — reproduces the same tree.
Takina · · 3 min read never represents values that can't exist — it marks unreachable code, exhaustive switches, and functions that always throw or loop forever.
Chisato · · 5 min read An IDS watches network traffic and alerts on threats; an IPS sits inline and blocks them automatically. How the two compare and when to use each.
Takina · · 4 min read TTFB measures the delay between a browser's request and the first byte of the response — a signal for server, network, and routing latency.
Takina · · 3 min read fetchpriority lets you tell the browser which resources matter most, overriding its default heuristics to load critical assets sooner.
Takina · · 4 min read TypeScript's readonly keyword blocks reassignment at compile time for properties, arrays, and tuples — with no runtime enforcement at all.
Takina · · 4 min read The Intl API formats dates, numbers, and currency using a user's locale without a library. How Intl.DateTimeFormat and Intl.NumberFormat work.
Takina · · 4 min read The prefers-reduced-motion media query detects a user's OS-level motion setting so CSS animations can be toned down or removed for people who need it.
Takina · · 4 min read A backend-for-frontend (BFF) is a dedicated backend layer for one client type — shaping, aggregating, and simplifying calls to shared downstream APIs.
Takina · · 4 min read requestIdleCallback runs low-priority JavaScript when the browser is idle, without blocking rendering, input, or the main thread.
Takina · · 5 min read Turbopack is a Rust-based bundler built for incremental speed; Webpack is the mature, plugin-heavy standard. How they differ and when to pick each.
Takina · · 4 min read HTTP range requests let a client ask for just part of a resource, enabling video seeking, resumable downloads, and partial file fetches over HTTP.
Takina · · 4 min read object-fit controls how an image or video is cropped inside its box, and object-position controls which part of it stays visible. How they work together.
Takina · · 5 min read CSS's four global keywords control where a property's value comes from. How inherit, initial, unset, and revert differ, with a comparison table.
Takina · · 5 min read Promise.all() fails fast, allSettled() waits for every result, and race() returns whichever promise finishes first — how to choose correctly.
Takina · · 4 min read JavaScript's dynamic import() loads a module on demand and returns a promise, letting you split bundles and defer code until it's actually needed.
Takina · · 4 min read The spread operator (...) expands an iterable into individual elements; the rest operator collects elements back into an array. Same syntax, opposite jobs.
Takina · · 4 min read dvh, svh, and lvh fix the classic mobile vh bug where browser toolbars cut off full-height layouts. Here's what each unit measures and when to use it.
Takina · · 4 min read TypeScript's as const assertion locks a value to its literal, readonly type instead of widening it. How it works and when to reach for it.
Chisato · · 5 min read Session fixation tricks a victim into using an attacker-known session ID, so logging in hands the attacker an authenticated session too.
Takina · · 4 min read The ResizeObserver API lets JavaScript watch an element's box size and react without polling or resize-event hacks. How it works and when to use it.
Chisato · · 4 min read IDOR is an access control flaw where an app trusts a user-supplied ID to fetch a record without checking the requester actually owns it.
The Lycoris Team · · 4 min read URI paths, custom headers, and content negotiation are the three common ways to version an API. Tradeoffs of each, and how to avoid breaking clients.
Takina · · 5 min read A JavaScript memory leak happens when a reference outlives its usefulness and the garbage collector can't reclaim it. Common causes and how to find them.
Takina · · 4 min read localStorage, sessionStorage, and cookies all store data in the browser, but differ in lifetime, size limits, and whether the server can see them.
Takina · · 4 min read repeat() and minmax() let CSS Grid build responsive layouts without media queries. How the two functions combine, and common patterns.
Chisato · · 4 min read Clickjacking tricks a user into clicking something they can't see, hidden inside an invisible iframe. How the attack works and how to stop it.
Chisato · · 4 min read Subresource Integrity lets a browser verify a fetched script or stylesheet matches an expected hash, blocking a tampered CDN asset from running.
Takina · · 4 min read Import maps let browsers resolve bare module specifiers like "react" to real URLs, enabling native ES module imports without a bundler.
Takina · · 5 min read The Push API lets a web app send notifications through a service worker, even when the site isn't open in a browser tab. Here's the full flow.
Takina · · 4 min read Z-index only compares elements within the same stacking context. What creates a new context, how they nest, and why z-index: 9999 sometimes fails.
Takina · · 5 min read Gzip and Brotli both shrink HTTP responses before they hit the wire. How each algorithm works, and why Brotli usually compresses text tighter.
Takina · · 5 min read How ::before and ::after generate content without extra markup, which properties they need, and common patterns like icons and counters.
Takina · · 5 min read JavaScript destructuring unpacks values from arrays and objects into variables in one expression. How it works, with the rest and spread operators.
Takina · · 4 min read How JavaScript determines what this refers to: default, implicit, explicit, and new binding, plus why arrow functions behave differently.
Chisato · · 4 min read DNS over HTTPS encrypts domain name lookups inside HTTPS traffic, hiding queries from network eavesdroppers. How DoH works and how it differs from DNSSEC.
Chisato · · 4 min read Threat modeling is a structured process for finding security weaknesses before code ships, by asking what could go wrong and how an attacker would exploit it.
Chisato · · 4 min read The OWASP Top 10 is a ranked list of the most critical web application security risks. What's on it, why it matters, and how teams use it.
Takina · · 5 min read Type guards are functions and checks that narrow a TypeScript union to a specific type at runtime. How typeof, instanceof, in, and custom guards work.
Takina · · 4 min read HTTP status codes are three-digit responses that tell a client what happened to its request. A practical tour of the codes that actually matter.
Takina · · 4 min read The Popover API gives HTML a built-in popover element with the popover attribute — top-layer rendering, light-dismiss, and no JavaScript required.
Takina · · 5 min read The CSS will-change property hints the browser to prepare an element for an upcoming change, moving it to its own compositor layer. When to use it and when not to.
Takina · · 4 min read TypeScript function overloads let one function name accept multiple call signatures with different types. How overload signatures work and when to use them.
Takina · · 4 min read CSS Houdini is a set of low-level browser APIs that let JavaScript hook into the CSS rendering pipeline itself, instead of working around it.
Takina · · 4 min read Tagged template literals let a function intercept a template string's parts before interpolation — the mechanism behind safe SQL, styled-components, and i18n.
Chisato · · 4 min read PKCE hardens the OAuth authorization code flow against interception, and is now recommended for every client type, not just mobile and single-page apps.
Takina · · 5 min read IndexedDB is a browser API for storing large amounts of structured data client-side, with indexes, transactions, and no size limit like localStorage.
Takina · · 4 min read Event delegation attaches one listener to a parent instead of one per child, using event bubbling to catch clicks from elements added after page load.
Takina · · 4 min read The native dialog element gives you modals and popovers with built-in focus trapping and accessibility, no JavaScript library required. Here's how it works.
Takina · · 3 min read The :nth-child() family selects elements by position among siblings, using a simple an+b formula. How it works and where it beats manually added classes.
Takina · · 4 min read The Intersection Observer API tells you when an element enters or leaves the viewport, without scroll-event polling. How it works and where to use it.
Chisato · · 4 min read HttpOnly, Secure, and SameSite are cookie attributes that block script access, force HTTPS, and limit cross-site sending. Here's what each one actually stops.
Takina · · 4 min read WebP, AVIF, and JPEG trade off compression, browser support, and encode speed differently. Which format to use where, and how to serve fallbacks safely.
Takina · · 4 min read structuredClone() is a built-in JavaScript function for deep-copying values, including cycles and typed arrays, without the workarounds JSON tricks require.
Takina · · 4 min read The CSS font-display property controls whether text waits for a web font or renders in a fallback first. Here's how swap, block, and optional differ.
Takina · · 4 min read HTTP/2 fixed request multiplexing but stayed on TCP; HTTP/3 moves to QUIC over UDP to kill head-of-line blocking at the transport layer. The real differences.
Takina · · 4 min read Responsive images use srcset and sizes to let the browser pick the right file for each screen, cutting wasted bytes without extra JavaScript.
Chisato · · 4 min read A timing attack infers secret data by measuring how long an operation takes to run. How timing side channels leak information and how to close them.
Takina · · 4 min read grid-template-areas lets you name grid regions and place items by name instead of row and column numbers, turning your CSS into a visual map of the layout.
Takina · · 4 min read Template literal types let TypeScript build string types from other types, like JavaScript template strings. How they work, with practical patterns.
Takina · · 4 min read CSS gradients render smooth color transitions directly in the browser — no image files. How linear, radial, and conic gradients work, with practical examples.
Takina · · 4 min read The Fetch API is JavaScript's built-in interface for making HTTP requests. How it works, its promise-based flow, and where it trips people up.
Takina · · 4 min read TypeScript's interface and type both describe object shapes, but they diverge on declaration merging, unions, and extension. When to reach for each.
Takina · · 4 min read content-visibility lets the browser skip layout, style, and paint for off-screen content, cutting rendering cost on long pages without JavaScript.
Takina · · 4 min read Solid.js uses fine-grained signals and no virtual DOM; React re-renders components and diffs. How the two reactivity models differ in practice.
Takina · · 5 min read SSE streams one-way updates over plain HTTP; WebSockets open a full-duplex channel. How they differ and which fits your real-time feature.
Takina · · 4 min read Mapped types transform one type into another by iterating over its keys — the mechanism behind Partial, Readonly, Record, and Pick under the hood.
Takina · · 4 min read backdrop-filter blurs, darkens, or otherwise adjusts whatever sits behind an element, powering frosted-glass UI without extra markup or JavaScript.
Takina · · 4 min read The Speculation Rules API lets browsers prerender pages before a click, making navigation feel instant. How it works and how it differs from prefetch.
Takina · · 4 min read TypeScript enums group named constants under one type. How numeric, string, and const enums compile, and when a union type is the better choice.
Takina · · 4 min read A JavaScript Symbol is a guaranteed-unique primitive used for collision-free object keys. How Symbols work, well-known Symbols, and when to use them.
Chisato · · 4 min read Certificate Transparency is a public, tamper-evident log of every TLS certificate issued, letting anyone detect mis-issued or rogue certificates.
Takina · · 4 min read CSS counters auto-number elements with counter-reset, counter-increment, and the counter() function — no JavaScript or manual list numbers required.
Chisato · · 5 min read RBAC grants access based on a user's assigned role; ABAC evaluates attributes of the user, resource, and context at request time. How they compare.
Takina · · 4 min read Progressive enhancement builds a working page with HTML first, then layers CSS and JavaScript on top — so a slow network or failed script never breaks the core experience.
Chisato · · 5 min read Certificate pinning hardcodes which certificate or public key an app should trust, blocking attacks that rely on a rogue but validly signed certificate.
Takina · · 4 min read A discriminated union tags each variant of a type with a shared literal field, letting TypeScript narrow the type automatically inside a switch or if check.
Takina · · 4 min read var, let, and const differ in scope, hoisting behavior, and reassignment rules. Here's what each one actually does and when to reach for it.
Takina · · 4 min read CSS env() reads values from the browser or device itself, like safe-area insets on notched phones, instead of from your own custom properties.
Takina · · 4 min read ESLint catches bugs and enforces code patterns; Prettier only reformats how code looks. Why most JavaScript projects run both, not one or the other.
Takina · · 4 min read Optional chaining (?.) short-circuits on null or undefined instead of throwing; nullish coalescing (??) supplies a default only for null or undefined.
Chisato · · 4 min read Encryption at rest protects stored data on disk; encryption in transit protects data moving over a network. Why production systems need both.
Chisato · · 4 min read gRPC uses binary Protocol Buffers over HTTP/2 for fast, typed service calls; REST uses JSON over HTTP for accessible, resource-based APIs. How to pick.
Takina · · 4 min read :focus-visible only shows a focus ring for keyboard and other non-pointer input, while :focus matches every focus event, including mouse clicks.
Takina · · 4 min read Prototypal inheritance means JavaScript objects inherit properties directly from other objects via a prototype chain, not from classes. How it works.
Chisato · · 4 min read The same-origin policy stops a script from one site reading data loaded from another. How origins are compared, and how CORS and cookies fit in.
Takina · · 4 min read Web workers run scripts off the main thread for parallel computation. Service workers intercept network requests for offline and caching. How they differ.
Chisato · · 4 min read A man-in-the-middle attack secretly intercepts traffic between two parties. How MITM attacks work, common variants, and the defenses that stop them.
Chisato · · 5 min read HSTS is a response header that tells browsers to only ever connect to a site over HTTPS, closing the gap that lets attackers strip encryption.
Takina · · 4 min read map, filter, and reduce transform arrays without loops or mutation. How each one works, when to reach for it, and where they trip people up.
Takina · · 4 min read TypeScript's unknown forces a type check before use; any opts out of type checking entirely. When to reach for each in real code.
Takina · · 4 min read A source map is a file that maps minified, bundled, or transpiled code back to its original source, so debuggers and stack traces stay readable.
Takina · · 4 min read CSS transitions animate a single state change; animations run independent, repeatable keyframe sequences. How to pick the right one for the job.
Takina · · 4 min read Conditional types let TypeScript pick a type based on another type, using T extends U ? X : Y — the foundation of most advanced type utilities.
Chisato · · 4 min read A VPN encrypts traffic between your device and a remote server, tunneling it through an untrusted network. How VPN tunneling and encryption work.
Takina · · 4 min read clip-path and mask-image clip or fade elements into custom shapes in pure CSS, replacing image editors and SVG sprites for cropping.
Takina · · 3 min read Currying transforms a multi-argument function into a chain of single-argument functions. How currying and partial application work in JavaScript.
Takina · · 3 min read Lazy loading defers offscreen images until they near the viewport. Comparing the native loading attribute against Intersection Observer-based approaches.
Chisato · · 4 min read Credential stuffing tests stolen username-password pairs against other sites, exploiting reused passwords. How it works and the defenses that actually stop it.
Takina · · 4 min read Vue uses a template syntax with a reactive proxy system; React uses JSX with a virtual DOM. How the two frameworks differ and when to pick each.
Chisato · · 4 min read The TLS handshake is how a browser and server agree on encryption and verify identity before any data is exchanged. Here's each step explained.
Takina · · 4 min read Node.js streams process data in chunks instead of loading it all into memory. How readable, writable, and transform streams work, and when to reach for them.
Takina · · 4 min read How to build dark mode in CSS with the prefers-color-scheme media query and the light-dark() color function, without duplicating your palette.
Takina · · 5 min read Cache-Control and ETag are the two headers that control HTTP caching — how long a response stays fresh and how to revalidate it cheaply, explained.
Takina · · 5 min read A WeakMap holds object keys without blocking garbage collection, unlike a regular Map. How WeakMap and WeakRef work and when to reach for them.
Takina · · 3 min read CSS scroll snap locks scrolling to fixed positions using scroll-snap-type and scroll-snap-align, no JavaScript required. Here's how it works.
Takina · · 4 min read JavaScript's Map and Set are built-in collections with cleaner semantics than plain objects and arrays. Here's how each works and when to reach for one.
Takina · · 4 min read The Temporal API is JavaScript's built-in replacement for Date — immutable, timezone-aware objects for dates, times, and durations.
Takina · · 4 min read Resource hints like preload, prefetch, and preconnect tell the browser what to fetch early. Here's how each one works and when to reach for it.
Takina · · 4 min read TypeScript's satisfies operator checks a value against a type without widening or erasing its inferred literal type. Here's when to reach for it.
Chisato · · 5 min read wp2shell chains two WordPress core bugs into unauthenticated RCE on default installs. What CVE-2026-60137 and CVE-2026-63030 do, who's affected, how to patch.
Chisato · · 5 min read SSO lets a user log in once with one identity provider and access multiple apps without re-entering credentials. How the trust relationship works.
Takina · · 4 min read CSS anchor positioning lets an element attach to another element's edges without JavaScript. How anchor(), position-anchor, and fallbacks work.
Takina · · 4 min read text-wrap: balance evens out line lengths in headlines using the browser's own layout engine, no JavaScript required. How it works and when to use it.
Takina · · 4 min read Astro's islands architecture ships static HTML by default and hydrates only the interactive components that need JavaScript. Here's how it works.
Takina · · 4 min read TypeScript decorators attach reusable behavior to classes and members with an @ syntax. How class, method, and field decorators work, with real examples.
Takina · · 4 min read @property registers a CSS custom property with a type, initial value, and inheritance rule — unlocking smooth animation and real error checking.
Chisato · · 4 min read SQL injection lets attackers run arbitrary database queries by smuggling SQL into user input. Parameterized queries close the hole. Here's how it works.
Takina · · 4 min read The CSS aspect-ratio property locks a box's width-to-height ratio in one line, replacing the old padding-top percentage trick. Syntax, gotchas, and use cases.
Takina · · 4 min read Shadow DOM attaches an isolated DOM tree to an element so a component's styles and markup can't leak in or out. Here's how it actually works.
Takina · · 4 min read npm, pnpm, and Yarn all install the same packages but differ in speed, disk usage, and monorepo support. Here's how to pick the right one.
Takina · · 4 min read AbortController lets JavaScript cancel an in-flight fetch or async task on demand, preventing stale responses from overwriting newer state.
Takina · · 5 min read ESM and CommonJS are JavaScript's two module systems — how import/export differs from require/module.exports, and when each one is used.
Chisato · · 3 min read Cross-site scripting (XSS) injects malicious scripts into pages other users view. How stored, reflected, and DOM-based XSS work, and how to prevent them.
Takina · · 4 min read Optimistic UI updates the interface immediately, before the server confirms a change, then rolls back if the request fails — for apps that feel instant.
Takina · · 4 min read CSS clamp() scales a value smoothly between a minimum and maximum, letting font sizes and spacing flex with the viewport without media queries.
Takina · · 4 min read Web Components are browser-native APIs for building reusable, encapsulated custom elements that work in any framework, or none at all.
Takina · · 4 min read TypeScript utility types like Partial, Pick, Omit, and Record transform existing types instead of redeclaring them. How the common ones work, with examples.
Chisato · · 4 min read Password hashing turns a password into a one-way, salted digest so a stolen database doesn't hand over credentials. How bcrypt and Argon2 work.
Takina · · 4 min read A monorepo holds multiple projects in one repository with shared tooling and atomic commits. How it compares to splitting projects across separate repos.
Takina · · 4 min read oklch(), lch(), and color-mix() let CSS describe color perceptually and blend it directly in the browser. How each works and when to reach for them.
Chisato · · 4 min read SSRF tricks a server into requesting unintended destinations, reaching internal systems attackers couldn't otherwise touch. How it works and how to stop it.
Chisato · · 4 min read A WAF is a filter sitting in front of a web app that inspects HTTP traffic for attack patterns like SQL injection and blocks malicious requests.
Takina · · 4 min read CSS scroll-driven animations tie keyframes to scroll position instead of a clock, running smoothly off the main thread. Here's how the timeline model works.
Takina · · 3 min read CSS subgrid lets a nested grid item inherit its parent's row and column tracks, so child elements line up across unrelated components.
Takina · · 4 min read SSR renders pages per request; SSG renders them at build time. How the tradeoff affects speed, freshness, and hosting cost — and how to pick.
Takina · · 4 min read Generators are functions that pause and resume with the yield keyword, producing values lazily on demand instead of computing them all at once.
Takina · · 4 min read The critical rendering path is the sequence a browser follows from HTML bytes to painted pixels — DOM, CSSOM, render tree, layout, paint.
Takina · · 4 min read px is a fixed unit, em scales to a parent's font size, and rem scales to the root. How to choose between them for sizing and typography in CSS.
The Lycoris Team · · 4 min read An idempotent operation produces the same result no matter how many times it runs. Why that matters for retries, payments, and reliable APIs.
Takina · · 4 min read REST exposes fixed endpoints per resource; GraphQL lets clients query exactly the fields they need through one endpoint. How to choose between them.
Takina · · 4 min read :is() and :where() group selector lists into one rule. Same matching logic, different specificity — here's when to reach for each.
Takina · · 4 min read A PWA is a website built to behave like a native app — installable, offline-capable, and fast — using standard web technologies, not app-store code.
Takina · · 4 min read TypeScript generics let functions and types work with any type while preserving the specific type used at each call site, avoiding both duplication and any.
Takina · · 4 min read CSS cascade layers let you group styles into named layers with explicit priority order, so specificity fights between resets, components, and overrides disappear.
The Lycoris Team · · 4 min read An ORM lets you query a database using your programming language's objects instead of raw SQL. How they work, what they trade off, and when to skip one.
Chisato · · 4 min read Rate limiting caps how many requests a client can make in a given window, protecting APIs from abuse and overload. Common algorithms compared.
Chisato · · 4 min read MFA requires two or more independent proofs of identity — something you know, have, or are — to stop stolen passwords from being enough to break in.
Takina · · 4 min read Async/await is syntactic sugar over Promises, not a different mechanism. How each looks in practice, and when to still reach for raw Promises.
Takina · · 4 min read The virtual DOM is an in-memory copy of the UI tree that frameworks diff against the previous version to batch and minimize real DOM updates.
Takina · · 4 min read :has() is CSS's relational pseudo-class — it lets a selector match an element based on what's inside or after it, finally enabling a parent selector.
Chisato · · 4 min read A Content Security Policy is an HTTP header that restricts what scripts and resources a page can load, blocking most XSS attacks by default.
Takina · · 4 min read A JavaScript Proxy wraps an object and intercepts operations like get and set through traps. How traps work, with practical examples and Reflect.
Takina · · 4 min read A web worker runs JavaScript on a background thread, freeing the main thread to keep the UI responsive. How workers communicate and when to use one.
Takina · · 4 min read Web accessibility (a11y) means building sites usable by people with disabilities. The core principles, semantic HTML, ARIA, and common patterns.
Chisato · · 4 min read CSRF tricks a logged-in user's browser into sending an unwanted authenticated request. Cookies, tokens, and SameSite settings are the defense.
Takina · · 5 min read Svelte compiles away at build time; React ships a runtime and virtual DOM. Bundle size, reactivity model, and ecosystem tradeoffs compared.
Takina · · 5 min read Native CSS nesting lets you nest selectors inside a parent rule without a preprocessor. How the syntax works, the & selector, and specificity gotchas.
Takina · · 4 min read CSS custom properties are native variables that cascade, inherit, and update live at runtime. How they work, why they beat preprocessor variables.
Takina · · 3 min read CSS logical properties like margin-inline and padding-block size and space elements relative to writing direction, not fixed physical sides.
Takina · · 5 min read Microsoft shipped TypeScript 7.0 with a Go-native compiler that's roughly 10x faster than 6.0. What changed, what breaks, and how to upgrade.
Takina · · 4 min read Tree shaking removes unused exports from a JavaScript bundle at build time, shrinking file size by relying on ES module static structure.
Takina · · 4 min read A service worker is a script that runs separately from your page, intercepting network requests to enable offline access, caching, and push notifications.
Takina · · 5 min read A JavaScript closure is a function that remembers the variables from where it was defined. How closures work, why they matter, and the classic loop gotcha.
Takina · · 5 min read CSS specificity is the scoring system that decides which rule wins when several target the same element. How the weights work and how to keep them low.
Takina · · 4 min read The CSS box model defines how every element is sized — content, padding, border, and margin. Here's how the layers stack and why box-sizing matters.
Chisato · · 6 min read Caching keeps a copy of expensive data somewhere faster. How cache-aside, write-through, and TTLs work — and why invalidation is the hard part.
Takina · · 3 min read htmx lets you build dynamic, interactive pages with HTML attributes — no SPA, no build step. Learn the core ideas and ship a working live-search example in minutes.
The Lycoris Team · · 5 min read JSON Schema is a vocabulary for describing and validating the shape of JSON data. How schemas work, where they show up, and the keywords that matter.
Takina · · 4 min read WebRTC lets browsers stream audio, video, and data directly between peers — no plugins. How getUserMedia, RTCPeerConnection, and ICE/STUN/TURN fit together.
The Lycoris Team · · 4 min read Monoliths ship faster early; microservices buy independent scaling and team autonomy at the cost of distributed complexity. How to choose.
Chisato · · 4 min read OAuth 2.0 handles authorization, OIDC adds authentication, and SAML powers enterprise SSO. How the three protocols differ and which one your app needs.
Takina · · 3 min read HTML is the standard markup language that structures every web page. Learn how elements, tags, and semantic HTML shape the web.
Takina · · 4 min read Container queries let components respond to the space they're given, not the viewport. Here's how they work and when to reach for them.
Chisato · · 5 min read The padlock in your address bar hides a clever handshake. Here's what actually happens when you load an HTTPS site — encryption, certificates, and trust.
Chisato · · 5 min read OAuth 2.0 grant types are the flows apps use to get access tokens. Authorization code with PKCE, client credentials, device flow — and when to use each.
The Lycoris Team · · 5 min read JSON and YAML represent the same data — the difference is syntax, strictness, and footguns. Where each format wins, and which to pick for configs and APIs.
Takina · · 4 min read Grid and Flexbox aren't rivals — they solve different problems. A simple rule of thumb, with examples, for choosing the right layout tool every time.
Takina · · 5 min read WebAssembly lets near-native code run in the browser and beyond. It's no longer experimental — here's where it's actually being used and why it matters.
Chisato · · 6 min read OAuth 2.0 lets apps access your data without your password. How the authorization flow works, what PKCE adds, and how OAuth differs from authentication.
Takina · · 4 min read A WebSocket is a protocol for full-duplex, persistent communication over a single TCP connection. Learn how it works, when to use it, and what the alternatives are.
Takina · · 3 min read GraphQL is a query language for APIs where clients request exactly the data they need. Learn how it works, when to use it, and how it compares to REST.
Takina · · 4 min read CORS lets a server opt in to cross-origin browser requests, relaxing the same-origin policy in a controlled way. Why it exists and how to fix CORS errors.
The Lycoris Team · · 5 min read A growing movement wants apps that work offline, sync seamlessly, and keep your data yours. Here's what 'local-first' means and why developers are excited.
Takina · · 4 min read JavaScript is single-threaded, yet pages stay responsive. A clear tour of the call stack, task queue, and microtasks — with examples you can run.
Takina · · 4 min read CSS is the language that styles every web page. Learn how selectors, the cascade, the box model, and modern layout tools like flexbox and grid work.
The Lycoris Team · · 3 min read An API is a defined contract that lets one piece of software talk to another. Learn what APIs are, how they work, and why modern software runs on them.
The Lycoris Team · · 6 min read JSON is a lightweight text format for structured data — the default for APIs and config files. Syntax, examples, common mistakes, and why it beat XML.
Takina · · 5 min read Signals offer fine-grained reactivity with automatic dependency tracking — and nearly every major framework has adopted them. Here's why the model won.
Takina · · 4 min read Tailwind v4 rewrites the engine from scratch for dramatically faster builds and moves configuration into CSS itself. Here's what changed and how to work with it.
Chisato · · 4 min read A JWT is a compact, signed token that carries JSON claims — identity and authorization without a session lookup. How it works and what to watch out for.
Takina · · 4 min read The View Transitions API brings smooth, app-like transitions to the web without a heavy SPA framework. Here's how it works and how to use it today.
Takina · · 4 min read Hydration is how JavaScript wakes up server-rendered HTML so static markup becomes interactive. The cost, the tradeoffs, and the modern alternatives.
Takina · · 5 min read An honest comparison of Bun and Node.js in 2026 — speed, ecosystem, built-in tooling, and when each runtime actually wins.
Takina · · 4 min read Astro 6 lands with a refined Content Layer, faster builds, and tighter defaults — what matters for content sites and how to upgrade calmly.
The Lycoris Team · · 3 min read A REST API is a web API that follows a set of conventions built on HTTP. Learn how URLs, HTTP methods, status codes, and JSON fit together.
Takina · · 4 min read HTTP/3 runs over QUIC instead of TCP, cutting head-of-line blocking and speeding up connections with built-in TLS 1.3. What changed and why it matters.
Takina · · 3 min read JavaScript is the programming language that makes web pages interactive. Learn how it works alongside HTML and CSS, and why it runs nearly everywhere.
Takina · · 5 min read React Server Components render exclusively on the server and stream a serialized result — no client JS shipped for that component. Here's what that actually means.
Takina · · 4 min read The DOM is the live in-memory tree browsers build from your HTML, which JavaScript reads and manipulates. Learn how it works and why it matters.
Takina · · 3 min read TypeScript adds a safety net to JavaScript without slowing you down. Here's how to set it up, the handful of concepts that matter, and how to adopt it gradually.
Takina · · 4 min read Vite serves source over native ES modules in development and bundles with Rollup for production. Why it replaced Webpack for most front-end projects.
Takina · · 5 min read Core Web Vitals affect both user experience and search ranking. Here's what LCP, INP, and CLS actually measure and the highest-impact ways to fix each one.
Takina · · 4 min read WebGPU is far more than a WebGL replacement. It exposes compute shaders, maps to modern GPU APIs, and enables in-browser ML inference.
Takina · · 4 min read A webhook is an HTTP callback that notifies your server the moment something happens — no polling. How webhooks work and how to use them safely.
Takina · · 4 min read Server-Sent Events stream real-time updates over a single HTTP connection. How SSE works, when to use it, and how it compares to WebSockets.
