Tag
Signals Corps 分析了 Common Crawl 中 2.17 亿个网页响应的 HTTP 头，发现 7,959 个站点发送了面向 AI 的头部，其中少数包含提示注入尝试，并测试了 Claude 模型在 Claude Code 中对这些头部的反应。研究指出头部注入是现有研究忽略的攻击路径，防御关键在于 fetch 工具传递给模型的内容范围。
Shopify CEO Tobi Lütke endorsed a proposal by Malte Ubl for documentation platforms to read preferred programming languages from the Accept-Language HTTP header, allowing AI agents and developers to receive code examples in languages like Python instead of TypeScript.
The article introduces a method to serve Markdown content directly to AI agents using HTTP Accept headers, reducing token usage, improving retrieval efficiency, and lowering latency for AI processing.
This article discusses passive browser identification techniques using HTTP header order, IP options, user-agent strings, and random number generator patterns.
The article discusses the limitations of relying on the Referrer header for tracking traffic sources, noting that many modern apps do not send this header. It advocates for using custom query strings as a form of digital etiquette to ensure link attribution remains legible across different platforms.
The article details a technical investigation into how an HTTP header caused time skew on the time.gov website, explaining the differences between NTP and HTTP time synchronization.
Datasette PR #2689 replaces token-based CSRF protection with Sec-Fetch-Site header-based protection, inspired by Go 1.25 and Filippo Valsorda's research, simplifying CSRF handling by eliminating the need for hidden form tokens.