#browser 9 articles

• Retry-After does not survive CORS — a header you send and the client reads can still arrive as nullgotchas / azure-functionsA cross-origin response exposes only the headers named in Access-Control-Expose-Headers plus a short safelist, so an API that sends Retry-After and a client that reads it still meet at null — both ends look right and a…
• speechSynthesis.cancel() does not stop chunked reading — it queues the next chunkgotchas / spfxThe utterance chain re-queues itself from onend; epoch counter bumped BEFORE cancel(), and no onEnd from a superseded chain
• A Promise wrapped around img.onload can hang forever — try/catch won't save yougotchas / spfxonload/onerror are not guaranteed to fire; try/catch guards rejection, not a Promise that never settles
• An SPFx web part that calls an intranet API makes Chrome and Edge ask every user for local network accessgotchas / spfxA *.sharepoint.com page fetching a host that resolves to a private IP is a local network request – Chrome (from 142) and Edge prompt every user and a refusal is a bare Failed to fetch; pre-allow the SharePoint origin…
• Console scripts on SharePoint hang because the ODSP service worker stalls every fetchgotchas / toolingA SharePoint page is controlled by the odspserviceworkerproxy.aspx service worker; when it gets stuck, every fetch from the page (even to another domain) never resolves while timers still run – a hard reload (Shift+F5)…
• DecompressionStream throws away the whole result when bytes follow the compressed datagotchas / spfxInflating a PDF FlateDecode stream in the browser fails completely because a line break sits between the data and endstream; trim trailing CR/LF and read chunk by chunk, keeping what arrived before the error
• Diagnostics that cannot survive the crash they are diagnosinggotchas / toolingFrozen threads stop repainting, sessionStorage dies with the tab and the next healthy run overwrites the crash report; persist synchronously and never gate recovery on a flag
• Fewer sites and sudden 403s usually mean a different account, not a tenant outagegotchas / securityA tenant-wide snippet run from a second browser window executes as whoever is signed in there; print currentuser and the visible-site count before you blame the tenant
• window.open with noopener returns null even when the tab opened — so your fallback runs every timegotchas / spfxCode that reads null as "blocked" runs its fallback every time: the e-mail opens twice (Outlook on the web and mailto:), the print window stays empty; open without the feature and set w.opener = null