Alex MacArthur on Mythryl: “I learned about “forbidden” request headers recently, which can’t be…”

I learned about “forbidden” request headers recently, which can’t be overridden by client-side JavaScript APIs. A subset also give some nice context about a request, like whether it came from someone directly navigating to a page. Useful stuff. Wrote more here: macarthur.me/posts/forbid...

macarthur.meI guess some request headers are more trustworthy than others.There's a subset of request headers that can't be modified by a spec-compliant user agent. Let's explore why they're useful for determining how and for what purpose a request was triggered.

31/3/25, 10:29 pm0 reposts0 likes

Post