How to determine browser type and version?

Usually, we check the user agent of http request header for the browser type and version.

Is there any other ways to verify it? People can write some script to simulate the http request with the custom header.

I want to ensure the traffic is from real browser. Is it possible? THX~

I think it will be easier to look at the IP address over the UA. I know most of the bots I build lately use some of the latest useragents, so I would assume most people do.

There are some obvious UA that are bots / search engines but run of the mill bots and scripts may cause you problems.

Even using the IP is basic - do a reverse look up, if the IP comes back to a residential type address then it could be human (or a bot net). If it goes to a server IP in a DC then its probably a bot.

It would be a tough one to spot in my opinion - you could look at the IP, the UA, the timezone of the machine and see if it looks real.

No, everything can be faked, even if you go with elaborate client side verifications.

Basically you need to check all these fields, but it's still not 100% bullet proof as jazzc said:

IP
UA
X_HTTP_FORWARDED_FOR (most of the proxies send this header, so if it's sent there's a big chance your traffic is not genuine)

jazzc said:

No, everything can be faked, even if you go with elaborate client side verifications.

Click to expand...

i agree with you, everything can be faked now.