Designing an API gateway on a laptop
An allowlist and a token check in front of an API, built in Caddy on a laptop, and the problems that turned up long before production.
← All tags
caddy
Real HTTPS on *.localhost, and the Firefox catch
Cookies and Origin checks only behave like production if the hostnames do, so every local site gets real HTTPS from a local CA, except Firefox has its own idea about which CAs to trust.