如何判断一个HTTP请求是浏览器请求还是应用程序请求？

布满荆棘的人生 2022-05-08 12:36 1777阅读 0赞

打开F12并刷新浏览器页面，可以从Request Headers中获取请求头Header信息，一般会有如下几项信息：  
**Accept**: */*  
Accept-Encoding: gzip, deflate, br  
Accept-Language: zh-CN,zh;q=0.9  
Connection: keep-alive  
Content-Length: 716  
**Content-Type**: text/plain;charset=UTF-8  
Host: [report.csdn.net:4089][report.csdn.net_4089]  
Origin: [https://bbs.csdn.net][https_bbs.csdn.net]  
Referer: [https://bbs.csdn.net/topics/380250315][https_bbs.csdn.net_topics_380250315]  
**User-Agent**: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36

比如我们浏览器请求头会附带[User-Agent][]属性，内容以[Mozilla][]开头。因此我们可以利用下列代码块简单区分HTTP请求是来自浏览器还是应用程序。  
请注意，网络爬虫或其它软件比如黄牛抢票小程序会模拟这个信息，所以仅从Request Header属性无法绝对实现区分请求是来自浏览器还是应用程序。

**简易模拟浏览器请求**  
在HTTP Request中设置User-Agent请求头消息：  
httpGet.setHeader(“User-Agent”, “Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0”); // 设置请求头消息User-Agent  
[https://blog.csdn.net/u013215018/article/details/55045392][https_blog.csdn.net_u013215018_article_details_55045392]

CloseableHttpClient httpClient=HttpClients.createDefault(); // 创建httpClient实例
    HttpGet httpGet=new HttpGet("http://www.tuicool.com/"); // 创建httpget实例
    httpGet.setHeader("User-Agent", "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0"); // 设置请求头消息User-Agent
    CloseableHttpResponse response=httpClient.execute(httpGet); // 执行http get请求
    HttpEntity entity=response.getEntity(); // 获取返回实体
    System.out.println("网页内容："+EntityUtils.toString(entity, "utf-8")); // 获取网页内容
    response.close();
    httpClient.close();

**简易区分HTTP请求是来自浏览器还是应用程序**  
1、获取请求的HttpServletRequest

HttpServletRequest httpServletRequest=ServletActionContext.getRequest();

2、拦截器中判断Request Header属性

String remoteAddr = httpServletRequest.getRemoteAddr();
    if (httpServletRequest.getHeader(“User-Agent”).startsWith(“Mozilla”)) {
        LOGGER.debug("remote request from browser, remote addr:{}.", remoteAddr);
    } else {
        LOGGER.debug("remote request from application, remote addr:{}.", remoteAddr);
        httpServletRequest.setAttribute(“solr.security.skip.cas”, "true");
    }

[有篇博客][Link 1]中提到可以通过Request Header中得“Content-Type”和“Accept”两个属性来判断请求是来自浏览器还是应用程序。**但是要注意的是，这个判断逻辑不一定适用于任何网站**，比如CSDN论坛的Request Header和Response Header都包含了Content-Type属性，通过这种方法可能会导致误判。

![Request Header解析][Request Header]

其实Request Header的属性在应用程序的代码里面都是可以手动添加的，所以仅仅是判断Header里面的任何属性，都是容易被模仿的。  
换个说法，如果这种在Request Header添加一两个属性就能轻易判断HTTP请求是来自浏览器还是应用程序方法就能work，那么你也太小瞧12306防范抢票软件的研发部门了！  
**如果有那么简单就能区分，哪还需要什么奇葩百出的验证码呢~~**  
[附上彩蛋1][1]  
[附上彩蛋2][2]  
[附上彩蛋3][3]

[report.csdn.net_4089]: http://report.csdn.net:4089
[https_bbs.csdn.net]: https://bbs.csdn.net
[https_bbs.csdn.net_topics_380250315]: https://bbs.csdn.net/topics/380250315
[User-Agent]: https://baike.baidu.com/item/%E7%94%A8%E6%88%B7%E4%BB%A3%E7%90%86/1471005?fromtitle=user-agent&fromid=10574244&fr=aladdin
[Mozilla]: https://baike.baidu.com/item/mozilla/7148071?fr=aladdin
[https_blog.csdn.net_u013215018_article_details_55045392]: https://blog.csdn.net/u013215018/article/details/55045392
[Link 1]: https://blog.csdn.net/qq_34937383/article/details/54645142
[Request Header]: /images/20220508/5ad6318edc4346e0913946a3fc3dc9ed.png
[1]: https://image.baidu.com/search/detail?ct=503316480&z=0&ipn=d&word=%E5%A5%87%E8%91%A9%E7%9A%84%E9%AA%8C%E8%AF%81%E7%A0%81&step_word=&hs=0&pn=2&spn=0&di=79048405370&pi=0&rn=1&tn=baiduimagedetail&is=0%2C0&istype=0&ie=utf-8&oe=utf-8&in=&cl=2&lm=-1&st=undefined&cs=888178749%2C151593638&os=3073948343%2C3025314282&simid=3428044121%2C203830493&adpicid=0&lpn=0&ln=1002&fr=&fmq=1539311734264_R&fm=&ic=undefined&s=undefined&se=&sme=&tab=0&width=undefined&height=undefined&face=undefined&ist=&jit=&cg=&bdtype=0&oriquery=&objurl=http%3A%2F%2Fwww.qcjl.com%2Fupfiles%2Fimage%2F20150317170107.jpg&fromurl=ippr_z2C%24qAzdH3FAzdH3Fooo_z%26e3Bqv3s_z%26e3Bv54AzdH3Fw7p5AzdH3F8can808b8_z%26e3Bip4s&gsm=0&rpstart=0&rpnum=0&islist=&querylist=
[2]: https://image.baidu.com/search/detail?ct=503316480&z=0&ipn=d&word=%E5%A5%87%E8%91%A9%E7%9A%84%E9%AA%8C%E8%AF%81%E7%A0%81&step_word=&hs=0&pn=3&spn=0&di=155349386280&pi=0&rn=1&tn=baiduimagedetail&is=0,0&istype=0&ie=utf-8&oe=utf-8&in=&cl=2&lm=-1&st=undefined&cs=2835617184,3120537362&os=352847461,380528510&simid=0,0&adpicid=0&lpn=0&ln=1002&fr=&fmq=1539311734264_R&fm=&ic=undefined&s=undefined&se=&sme=&tab=0&width=undefined&height=undefined&face=undefined&ist=&jit=&cg=&bdtype=0&oriquery=&objurl=http://easyread.ph.126.net/QDHTkFrH0ZZNZZHTM84ERA==/8796093022381770749.jpg&fromurl=ippr_z2C$qAzdH3FAzdH3Fj_z&e3B8mn_z&e3Bv54AzdH3F15vfAzdH3FllAzdH3Fda8c8d8a8cAzdH3FBAGDA9aNaalm9JVl_z&e3Bip4s&gsm=0&rpstart=0&rpnum=0&islist=&querylist=
[3]: https://image.baidu.com/search/detail?ct=503316480&z=0&ipn=d&word=%E5%A5%87%E8%91%A9%E7%9A%84%E9%AA%8C%E8%AF%81%E7%A0%81&step_word=&hs=0&pn=7&spn=0&di=41929129220&pi=0&rn=1&tn=baiduimagedetail&is=0%2C0&istype=0&ie=utf-8&oe=utf-8&in=&cl=2&lm=-1&st=undefined&cs=3973758604%2C1523167519&os=4158145736%2C3818052108&simid=3385924995%2C415899583&adpicid=0&lpn=0&ln=1002&fr=&fmq=1539311734264_R&fm=&ic=undefined&s=undefined&se=&sme=&tab=0&width=undefined&height=undefined&face=undefined&ist=&jit=&cg=&bdtype=0&oriquery=&objurl=http%3A%2F%2Fwww.qihaoip.com%2FUpload%2FImg%2F12%2F08%2F0441162808.png&fromurl=ippr_z2C%24qAzdH3FAzdH3Fooo_z%26e3Bqtiw5tr_z%26e3Bv54AzdH3Fgjof-da8c8dab-d8a8_z%26e3Bip4s&gsm=0&rpstart=0&rpnum=0&islist=&querylist=