'How might a server differentiate a request from Postman from one in the browser?
I'm trying to automate a process and need to be able to make a request that the browser is making. When I copy the request as a fetch from the Network tab in Chrome dev tools and repeat it in the console, it works fine. However, when I copy the curl and import the request into Postman, I get a 403 error.
- I've compared all the cookies--they're the same.
- I've copied the user-agent from my browser into Postman, but that didn't help.
- I've tried making the same request using axios in a node process, but also ran into the 403 error.
- It's a GET request, so there's no body to consider.
An example of a request that's successful in the browser but fails when copied elsewhere:
fetch("https://<omitted>", {
"headers": {
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"accept-language": "en-US,en;q=0.9",
"cache-control": "max-age=0",
"sec-ch-ua": "\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"99\", \"Google Chrome\";v=\"99\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"macOS\"",
"sec-fetch-dest": "document",
"sec-fetch-mode": "navigate",
"sec-fetch-site": "same-origin",
"sec-fetch-user": "?1",
"upgrade-insecure-requests": "1",
"cookie": <omitted>,
"Referer": "https://<same as request url>",
"Referrer-Policy": "strict-origin-when-cross-origin"
},
"body": null,
"method": "GET"
});
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
