Simon Willison’s Weblog

Subscribe

Monday, 22nd December 2025

Research environment-report — Running Claude Code on the web offers developers a versatile coding sandbox on Ubuntu 24.04, leveraging a broad toolkit that includes Python 3.11, Node.js 22, Go, Rust, and more, alongside developer utilities (Git, Make) and database clients (SQLite, PostgreSQL).
22nd Dec 2025, 12 am
Tool Photo print layout — Create custom photo print layouts for A4 pages with adjustable grid configurations, image fitting options, and portrait or landscape orientations. Users can add photos by uploading files or dragging and dropping them directly onto the page, then remove individual photos or clear the entire layout before printing. The preview displays actual print dimensions, allowing precise control over how photos will appear on the final printed output.
22nd Dec 2025, 3:22 am
Release preview-server 0.2a2 — Proxy server for previewing web app changes via uv
22nd Dec 2025, 6:19 am
Release preview-server 0.2a3 — Proxy server for previewing web app changes via uv
22nd Dec 2025, 3:19 pm

I just had my first success using a browser agent - in this case the Claude in Chrome extension - to solve an actual problem.

A while ago I set things up so anything served from the https://static.simonwillison.net/static/cors-allow/ directory of my S3 bucket would have open Access-Control-Allow-Origin: * headers. This is useful for hosting files online that can be loaded into web applications hosted on other domains.

Problem is I couldn't remember how I did it! I initially thought it was an S3 setting, but it turns out S3 lets you set CORS at the bucket-level but not for individual prefixes.

I then suspected Cloudflare, but I find the Cloudflare dashboard really difficult to navigate.

So I decided to give Claude in Chrome a go. I installed and enabled the extension (you then have to click the little puzzle icon and click "pin" next to Claude for the icon to appear, I had to ask Claude itself for help figuring that out), signed into Cloudflare, opened the Claude panel and prompted:

I'm trying to figure out how come all pages under http://static.simonwillison.net/static/cors/ have an open CORS policy, I think I set that up through Cloudflare but I can't figure out where

Off it went. It took 1m45s to find exactly what I needed.

Screenshot of Chrome - on the left is the Cloudflare dashboard. On the right a Claude chat panel which shows the final result: Summary Found it! Your open CORS policy for the /static/cors/ directory on static.simonwillison.net is configured through Cloudflare Transform Rules, specifically a Response Header Transform Rule named static.simonwillis.net/static/cors-allow/*. Here's exactly what's set up: Rule Configuration: Type: HTTP Response Header Transform Rule Applies to: Any URL matching https://static.simonwillison.net/static/cors-allow/* (wildcard match) Action: Modifies the response header access-control-allow-origin and sets it to * This is why all pages under that path have an open CORS policy — the * value for Access-Control-Allow-Origin means any origin can access those resources. Where to find/modify it in the dashboard: Go to your domain settings (simonwillison.net) Navigate to Rules > Rules Overview (in the left sidebar) Scroll down to Response Header Transform Rules (should show 2 active) Click on the rule named static.simonwillis.net/static/cors-allow/* to view or edit it

Claude's conclusion:

Found it! Your open CORS policy for the /static/cors/ directory on static.simonwillison.net is configured through Cloudflare Transform Rules, specifically a Response Header Transform Rule named static.simonwillis.net/static/cors-allow/*

There's no "share transcript" option but I used copy and paste and two gnarly Claude Code sessions (one, two) to turn it into an HTML transcript which you can take a look at here.

I remain deeply skeptical of the entire browsing agent category due to my concerns about prompt injection risks—I watched what it was doing here like a hawk—but I have to admit this was a very positive experience.

# 4:10 pm / chrome, ai, cloudflare, prompt-injection, generative-ai, llms, anthropic, claude, cors, ai-agents, browser-agents

2025 » December

MTWTFSS
1234567
891011121314
15161718192021
22232425262728
293031