Is there any way to detect if the user is using a real browser?
I am able to get user agent string from $_SERVER['HTTP_USER_AGENT']. But I am not sure if it was a real browser . Can we do anything at the php side to see if its real browser?
-
How do you define a "real browser"?Alex Howansky– Alex Howansky2021-02-22 20:12:42 +00:00Commented Feb 22, 2021 at 20:12
-
real browser means a request coming from real user and not faked access like a curl script.Lynn Rey– Lynn Rey2021-02-23 05:03:33 +00:00Commented Feb 23, 2021 at 5:03
Add a comment
|
1 Answer
No, you cannot reliably detect if a request was sent be a "real browser". (Assuming with "real browser" you mean something as a chrome/firefox/safari installed on a standard consumer OS and not something like curl, an ajax call or a crawler etc.)
Thats because the user-agent is nothing but a http header field. You can easily fake it. E.g. sending the following request using curl would look on your server as if I used a regular Chrome 44 on a Mac:
curl -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.89 Safari/537.36" http://your-website.com
But apart from the fact that the user-agent header is not reliable: You can of course use the field to decide whether the request was issued by an "expected" client. In 99.9% of all requests you will find the "real" client in the user agent header. But you shouldn't make any security-sensitive functions dependent on it.
1 Comment
Lynn Rey
thanks Simon for your message. what i am noticing in my access log is this.. there are requests coming to php access log but none is making to javascript or iframe. These requests are coming after I have done a meta refresh assuming that meta refresh will happen only using a valid browser. All user agents looks so valid. I was checking setcookie function of php to see if something is there that I could do for this.