I know that there are a myriad of defenses against CSRF attacks. CSRF, however, is strictly a browser vulnerability, and any request that comes from a non-browser is "automatically" (and rightly so) allowed through.
But...how do you know whether a request is from a browser or not? As far as I can tell, the only way is by examining the user-agent header.
This is all well and good, but, unlike the Origin and Referer headers, the user-agent header can be modified programmatically:
Note: The User-Agent header is no longer forbidden, as per spec — see forbidden header name list (this was implemented in Firefox 43,) so can now be set in a Fetch Headers object, via XHR setRequestHeader(), etc.
Is there some other way of determining whether a request came from a browser? Or, to defend against CSRF attacks, are you just doomed to block all non-browser requests as well?