What is Request?

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Where Request goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Free
The save that saved nothing
A user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.
Why does my app say saved when the save failed?
fetch only throws on network failures, not on HTTP errors. A 500 response still resolves, so code that shows a success message right after await fetch() reports success even when the server failed. Check response.ok, and show the error when it is false.
Walk it, free
Launch day · 4 minutes · Pro
Twelve requests on the home page
Your home page is mostly text and a sign-up button. The Network tab shows twelve API calls before it finishes loading, some of them failing.
Why does my page make so many API calls?
Often a shared layout or global provider fetches data for every page, so even a simple home page loads user details, notifications, orders and admin stats it never shows, and several components request the same data separately. Fetch data in the page or component that displays it, when it is displayed, and share one request instead of repeating it.
Read the fix
Who may see what · 4 minutes · Pro
The admin button
Only admins see the Refund button. A regular user has just refunded their own last three orders.
Is hiding the admin button enough?
No. Hiding a button only changes what is shown. Anyone can send the same request without the button. Every sensitive endpoint must check the caller's role on the server, reading that role from your database or a verified session, never from the request body.
Read the fix
The life of a click · 4 minutes · Pro
Logged out after an hour
Users fill in a long form, press Save, and get 'Unauthorized'. It always happens about an hour after they signed in.
Why do my users get logged out after an hour?
Access tokens are short-lived, often about an hour, and must be renewed with a refresh token. If nothing refreshes the session before requests, especially on server-rendered pages that cannot set cookies, users see 'Unauthorized'. Refresh the session in code that runs before each request.
Read the fix
Bills that explode · 4 minutes · Pro
2 million requests from one tab
You left your dashboard open overnight. Your database usage page shows 2 million requests from a single browser.
Why is my useEffect fetching in an infinite loop?
The effect changes one of its own dependencies, for example setting a state object it depends on, so every run triggers another run. Remove the self-update, depend only on values that really change, and watch the Network tab for repeating requests. Select only the columns you display to reduce data transfer.
Read the fix
Don't trust the browser · 4 minutes · Pro
One coupon, fifty orders
You posted a single-use 100%-off code for a launch giveaway. Within one second it was used for fifty free orders.
Why was a single-use coupon used many times?
Because the code checks whether the coupon was used and marks it used in two separate steps. When many requests arrive at once, they all pass the check before any update happens. Make the database enforce it in one step, for example an update that only succeeds where used is false, or a unique constraint on redemptions.
Read the fix

Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Endpoint: One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Authentication: Checking who someone is, usually by signing in.

All 62 terms in the glossary

Where Request goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

The life of a click · 4 minutes · Free

The save that saved nothing

A user clicks Save on their profile. A green 'Saved!' appears. When they reload, their changes are gone.

Why does my app say saved when the save failed?

fetch only throws on network failures, not on HTTP errors. A 500 response still resolves, so code that shows a success message right after await fetch() reports success even when the server failed. Check response.ok, and show the error when it is false.

Walk it, free

Launch day · 4 minutes · Pro

Twelve requests on the home page

Your home page is mostly text and a sign-up button. The Network tab shows twelve API calls before it finishes loading, some of them failing.

Why does my page make so many API calls?

Often a shared layout or global provider fetches data for every page, so even a simple home page loads user details, notifications, orders and admin stats it never shows, and several components request the same data separately. Fetch data in the page or component that displays it, when it is displayed, and share one request instead of repeating it.

Read the fix

Who may see what · 4 minutes · Pro

The admin button

Only admins see the Refund button. A regular user has just refunded their own last three orders.

Is hiding the admin button enough?

No. Hiding a button only changes what is shown. Anyone can send the same request without the button. Every sensitive endpoint must check the caller's role on the server, reading that role from your database or a verified session, never from the request body.

Read the fix

The life of a click · 4 minutes · Pro

Logged out after an hour

Users fill in a long form, press Save, and get 'Unauthorized'. It always happens about an hour after they signed in.

Why do my users get logged out after an hour?

Access tokens are short-lived, often about an hour, and must be renewed with a refresh token. If nothing refreshes the session before requests, especially on server-rendered pages that cannot set cookies, users see 'Unauthorized'. Refresh the session in code that runs before each request.

Read the fix

Bills that explode · 4 minutes · Pro

2 million requests from one tab

You left your dashboard open overnight. Your database usage page shows 2 million requests from a single browser.

Why is my useEffect fetching in an infinite loop?

The effect changes one of its own dependencies, for example setting a state object it depends on, so every run triggers another run. Remove the self-update, depend only on values that really change, and watch the Network tab for repeating requests. Select only the columns you display to reduce data transfer.

Read the fix

Don't trust the browser · 4 minutes · Pro

One coupon, fifty orders

You posted a single-use 100%-off code for a launch giveaway. Within one second it was used for fifty free orders.

Why was a single-use coupon used many times?

Because the code checks whether the coupon was used and marks it used in two separate steps. When many requests arrive at once, they all pass the check before any update happens. Make the database enforce it in one step, for example an update that only succeeds where used is false, or a unique constraint on redemptions.

Read the fix

Related terms

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Endpoint

One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Authentication

Checking who someone is, usually by signing in.