Programming and reading.

  • 0 Posts
  • 4 Comments
Joined 3 years ago
cake
Cake day: June 26th, 2023

help-circle



  • The value of this header cannot be set via JavaScript, so the server can assume that a) if this header is present, then the client is a web browser, and b) the value of the header can be trusted.

    This is already obviously wrong. It cannot be set from JavaScript, true, but any other client including scrapers may set it. So (a) is completely untrue, it being present implies nothing and (b) is also untrue by the nature of networking. You can only assume that it either came from a browser without manipulation, in which case the value can be trusted, or from an external source, in which case the attacker may set an arbitrary value.