alt Hacker NewsIt's really hard to detect it at request time. It's practically trivial for an attacker to fake headers to resemble a real browser.
It's really hard to detect it at request time. It's practically trivial for an attacker to fake headers to resemble a real browser.
You absolutely have options at request time. Arguably, some of the things you can only do at request time are part of a full and complete mitigation strategy.
You can fingerprint the originating TCP stack with some degree of confidence. If the request looks like it came from a Linux server but the user agent says Windows, that's a signal.
Likewise, the IP address making the request has geographic information associated with it. If my IP address says I'm in Romania but my browser is asking for the English language version of the page... That's a signal.
Similar to basic IP/Geo, you can do DNS and STUN based profiling, too. This helps you catch people that are behind proxies or VPNs.
To blur the line, you can use JavaScript to measure request timing. Proxies that are going to tamper with the request to hide its origins or change its fingerprint will add a measurable latency.