4 ms·
You could get clever by testing on the server whether the other headers are consistent with the User Agent (e.g. Accept). But yeah, ultimately it's a losing ga
by eli 13y ago
You could get clever by testing on the server whether the other headers are consistent with the User Agent (e.g. Accept).
But yeah, ultimately it's a losing game because you're trusting the client not to be compromised.
- brey 13y agoneat tool: chrome developer tools > network > rightclick a resource > copy as Curl > paste on command line allows you to replay a request, complete with all cookies and the exact same headers. yeah, aware this isn't what's wanted here, single request image etc etc ... but relevant.
- laumars 13y ago> You could get clever by testing on the server whether the other headers are consistent with the User Agent (e.g. Accept). Those headers can vary from machine to machine even when using the same browser. So you'd have a huge amount of testing, plus the big risk of braking legitimate requests. I just cant see how you could pull that off successfully. > But yeah, ultimately it's a losing game because you're trusting the client not to be compromised. Totally. Even if your solution did work, it's trivial to break again as you just add the appropriate headers to wget / curl as well as changing the user agent string.