I can confirm that this completely stops qeys from even sending a request on the page I'm testing it on. However, any client side protection can be bypassed, e

I can confirm that this completely stops qeys from even sending a request on the page I'm testing it on. However, any client side protection can be bypassed, especially if your adversary has write access to the code you're trying to protect. Maybe as an additional protection, qeys should, say, 1 in 7 [0] times, send a request regardless of whether the cookie present. [0] https://en.wikipedia.org/wiki/Morris_worm https://en.wikipedia.org/wiki/Morris_worm