On 2014-10-13 16:16, Nils Dagsson Moskopp wrote:
Anne van Kesteren <ann...@annevk.nl> writes:
Per XMLHttpRequest User-Agent has been off limits for script.
Reporting UA “Mozilla/4.0 (MSIE 6.0';DROP TABLE browsers;--"<u>{!=&})”
broke hilariously many sites when I did have set it as my default UA
string, even though I think it conforms to RFC 2616, section 14.43.
Again, that's a server security issue and not a browser one, attackers
would never use a "nice" browser for attacks anyway,
what point is there in background checks for security guards if the
window is always open so anyone can get in? ;)
Also, a script being able to set a custom XMLHttpRequest User-Agent
would be nice.
Not necessarily replace the whole thing but maybe concatenate to the end
of the browser one?
That way a webmaster would be able to see that the request is from
script Blah v0.9 when it really should be Blah v1.0 for example.
I always make sure that any Software I make uses a custom User-Agent,
same goes for any PHP scripts and so on, ditto if I use CURL, that way
the logs on the server will provide some insight.
--
Roger "Rescator" Hågensen.
Freelancer - http://www.EmSai.net/
