3 ms·
.NET's defective browser detection causing DoS
- mcraiha 6y agoNatural question is "Does this also apply to .NET Core?" since HttpCapabilitiesProvider does not exist in .NET Core
- ma-int 6y agoI mean...yes, it could happen like it is outlined in the article. But the easy (and imho proper way to do it completely avoids it: Don't rely on the User-Agent (like: at all) and do proper feature detection client side where you probably need it anyway. This way you also don't have the problem of having to maintain the list of browsers to features.
- mikerg87 6y agobrowser sniffing is bad, but I have seen the browser string used as a means of creating device id's to detect when a user is signing in from a new or different device or was compromised