Skip to main content
Information Security

Return to Question

Tweeted twitter.com/StackSecurity/status/807098632617021440
edited tags
Link
Anders
Anders
  • 65.8k
  • 25
  • 185
  • 226
Source Link
user132711
user132711
  • 21
  • 1

How do defend CSRF against requests that pretend not to be browsers?

I know that there are a myriad of defenses against CSRF attacks. CSRF, however, is strictly a browser vulnerability, and any request that comes from a non-browser is "automatically" (and rightly so) allowed through.

But...how do you know whether a request is from a browser or not? As far as I can tell, the only way is by examining the user-agent header.

This is all well and good, but, unlike the Origin and Referer headers, the user-agent header can be modified programmatically:

Note: The User-Agent header is no longer forbidden, as per spec — see forbidden header name list (this was implemented in Firefox 43,) so can now be set in a Fetch Headers object, via XHR setRequestHeader(), etc.

Oops.

Is there some other way of determining whether a request came from a browser? Or, to defend against CSRF attacks, are you just doomed to block all non-browser requests as well?