Tag
This article discusses passive browser identification techniques using HTTP header order, IP options, user-agent strings, and random number generator patterns.
The article discusses the limitations of relying on the Referrer header for tracking traffic sources, noting that many modern apps do not send this header. It advocates for using custom query strings as a form of digital etiquette to ensure link attribution remains legible across different platforms.
The article details a technical investigation into how an HTTP header caused time skew on the time.gov website, explaining the differences between NTP and HTTP time synchronization.
Datasette PR #2689 replaces token-based CSRF protection with Sec-Fetch-Site header-based protection, inspired by Go 1.25 and Filippo Valsorda's research, simplifying CSRF handling by eliminating the need for hidden form tokens.