4 ms·
a browser is typically not used to exploit this class of bugs.
by 5- 3y ago
a browser is typically not used to exploit this class of bugs.
- chatmasta 3y agoThere is precedent for deputizing the browser to stop this kind of bug with Access-Control-Allow-Headers. If the backend wants to default to ignoring multiple GET/POST parameters with the same name, then the browser could helpfully fail to make a request that attempts to send them.
- talkin 3y agoThe attacker doesnt’t use a compliant browser to make the request. User agent protections only help in situations where a regular user (or their software) is being tricked