'How might a server differentiate a request from Postman from one in the browser?

I'm trying to automate a process and need to be able to make a request that the browser is making. When I copy the request as a fetch from the Network tab in Chrome dev tools and repeat it in the console, it works fine. However, when I copy the curl and import the request into Postman, I get a 403 error.

  • I've compared all the cookies--they're the same.
  • I've copied the user-agent from my browser into Postman, but that didn't help.
  • I've tried making the same request using axios in a node process, but also ran into the 403 error.
  • It's a GET request, so there's no body to consider.

An example of a request that's successful in the browser but fails when copied elsewhere:

fetch("https://<omitted>", {
  "headers": {
    "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
    "accept-language": "en-US,en;q=0.9",
    "cache-control": "max-age=0",
    "sec-ch-ua": "\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"99\", \"Google Chrome\";v=\"99\"",
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": "\"macOS\"",
    "sec-fetch-dest": "document",
    "sec-fetch-mode": "navigate",
    "sec-fetch-site": "same-origin",
    "sec-fetch-user": "?1",
    "upgrade-insecure-requests": "1",
    "cookie": <omitted>,
    "Referer": "https://<same as request url>",
    "Referrer-Policy": "strict-origin-when-cross-origin"
  },
  "body": null,
  "method": "GET"
});


Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source