How can a url param '?i=1' detect a browser?

Sam

2/4/23, 3:51 PM

profreehost claims that a '?i=1' url GET param can protect their servers. I wondered how. I did use google before asking question, but all the results was about they are for security and how to remove them (if you have ssh access). I wanted to know the principles and maybe try to implement one for my own (on a vps) site. I guess the answer lies at the behavior of browsers.

0 + 0

security

http

scraping

Score:0

Server

bob

2/4/23, 4:22 PM

The parameter in itself is not the security mechanism, the security mechanism / browser check is the ability of the browser to store and use a cookie...

The pseudo logic is something along the lines of:

If a cookie is set:

-> assume that only "real browsers" can use cookies and show the page
If no cookie is set:
-> When URL parameter i is set and greater than 3 show error (assume that a browser that will follow multiple redirects but won't store cookies is not a real browser and/or broken)
-> ELSE
--> set the cookie
--> increment i with 1
--> return a redirect to URL?i=$i

0 + 0

Sam

2/4/23, 10:20 PM

Thanks, you mean the server will check whether the cookie is set? So when, in your flow, should it do so? Implementing this will result in losing the benefit of CDN, as a CDN should not cache anything with a cookie, right? And what should the cookie contain? creation time, UA, ip?