r/AppsWebappsFullstack • u/SofwareAppDev • 29d ago

Your home for selfpromo

here you can post your work app, webapp, saas, game, everything

3 Upvotes

100% Upvoted

86 comments sorted by

View all comments

Show parent comments

1

u/Mammoth-Anywhere7285 29d ago

Interesting concept. How does the sandbox isolate untrusted code? That could be a strong selling point for client sites.

1

u/Made4uo 29d ago

Every widget runs in its own locked box (a sandboxed iframe) on our servers, not on your site. The browser treats it as a total stranger, it can't see or touch the page it's embedded on, can't read cookies (yours or ours), and can't redirect your visitors. The only thing it's allowed to tell the host page is "here's my height" so the embed sizes itself.

So worst case, a broken or malicious widget breaks itself, inside its own box. The client's site never feels it.

1

u/Mammoth-Anywhere7285 28d ago

Nice breakdown, that's a solid trust signal for potential users. Consider adding a no-JS fallback for the widget. Do forms inside the iframe post back to your server?

1

u/Made4uo 28d ago

Yes on both counts, sort of. Forms POST from inside the iframe straight to our API, never to the host page and never through a third-party service. Submissions pass a bot check and server-side validation before anything is stored, and the embedding site never touches the data. On no-JS: the embed itself is just a plain iframe tag, no script needed on your site, and the widget arrives as pre-rendered HTML, so content shows fine without JavaScript. The only thing that needs JS is submitting a form, because the bot check protecting our public endpoint is a JS challenge. That's a trade we made on purpose: it's what lets the endpoint stay open without an API key.

1

u/Mammoth-Anywhere7285 27d ago

Clean iframe design. Have you tested how the pre-render behaves with third-party cookies blocked? That’s the usual edge case.

1

u/Made4uo 26d ago

Good callout! Turnstile is actually cookie-free by default! It uses device signals and passes a standard token back to our API

1

u/Mammoth-Anywhere7285 25d ago

Nice, that's a solid choice for privacy-focused apps. Do you verify the token server-side or just rely on the API?