WhatsApp Cloud API Webhooks on Localhost: The Verify-Token Handshake, Retries and App Secret SetupSet up WhatsApp Cloud API webhooks on localhost. Handle Meta's hub.challenge verify-token handshake, X-Hub-Signature-256 checks, retries and app12 min read·instatunnel.hashnode.dev2h ago
Chrome 154 Asks Before Loading HTTP: What Changes for Dev, Staging, and Test AutomationChrome 154 makes HTTPS-first the default for public sites. Learn what breaks in dev, staging & test automation, and how to fix it fast.14 min read·instatunnel.hashnode.dev2h ago
Forwarded Headers Are Not Trusted Input: X-Forwarded-For, Proto and Host Behind a TunnelBehind a tunnel, X-Forwarded-For, Proto and Host are untrusted input. Learn the right trustProxy settings for Express, Fastify, Django and Rails.11 min read·instatunnel.hashnode.dev1E2d ago
Provenance Isn't Proof: What to Check Before You `npm install -g` a Tunnel CLInpm provenance isn't proof of safety. Learn how to vet a tunnel CLI before npm install -g: pin versions, ignore-scripts, verify checksums, limit12 min read·instatunnel.hashnode.dev3d ago
Your Agent Card Needs a Public URL: Testing A2A Push Notifications on LocalhostYour A2A agent card needs a public URL. Learn to test push notifications on localhost with a stable tunnel and SSRF-safe webhook registration.19 min read·instatunnel.hashnode.dev3d ago
