4 ms·
If you're only relying on http headers, you're missing all but the most trivial of "bots". There are other things you could do with a backend-only approach but
by mh- 4y ago
If you're only relying on http headers, you're missing all but the most trivial of "bots". There are other things you could do with a backend-only approach but if your code doesn't run where the device connects to (e.g. you're behind a load balancer or other reverse proxy), those are largely unworkable.
- shanebellone 4y ago"If you're only relying on http headers, you're missing all but the most trivial of bots" Very true. Capturing, processing, and storing analytics data long-term is expensive. If I eliminate even 50% of that noise, the savings will be worth it. I'm attempting to identify the bulk of bots with http headers and real-time session monitoring. I also have an unauthorized list (known bad actors) and an ignore list (search bots, etc.). It works pretty well but definitely doesn't begin address the problem as a whole (from a security perspective). It's an interesting and complex topic.