Yesterday, I started looking a site compatibility bug where a page’s layout is intermittently busted. Popping open the F12 Tools on the failing page, we see that a stylesheet is getting blocked because it lacks a CORS Access-Control-Allow-Origin response header: We see that the client demands the header because the LINK element that references itContinue reading “CORS and Vary”
Category Archives: web
FiddlerCore and Brotli compression
Recently, a developer asked me how to enable Brotli content-compression support in FiddlerCore applications, so that APIs like oSession.GetResponseBodyAsString() work properly when the entity body has been compressed using brotli. Right now, support requires two steps: Put brotli.exe (installed by Fiddler or off Github) into a Tools subfolder of the folder containing your application’s executable. Ensure that theContinue reading “FiddlerCore and Brotli compression”
File Paths in Windows
Handling file-system paths in Windows can have many subtleties, and it’s easy to forget how some of this very intricate system works under the covers. Happily, a .NET developer has started blogging a bit about file paths, presumably as they work to improve .NET’s handling of paths longer than the legacy MAX_PATH limit of 260Continue reading “File Paths in Windows”
Downloads and the Mark-of-the-Web
Last update: September 1, 2026 tl;dr: Downloaders can taint a file originating from the web so that file-handling apps will handle the file more cautiously. Background To help protect the user and their device, Windows and its applications will often treat files originating from the Internet more cautiously than files generated locally. The Windows SecurityContinue reading “Downloads and the Mark-of-the-Web”
Authenticode and ClickOnce
On my old IEInternals blog, I posted a fair bit about using Authenticode to sign your programs so that their origins could be identified and to avoid triggering warnings from SmartScreen. My last post on that blog before Microsoft took it away was about using a hardware token to improve security of your certificate’s privateContinue reading “Authenticode and ClickOnce”