Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
.NET's defective browser detection causing DoS (gundersen.net)
14 points by fegu on Jan 30, 2021 | hide | past | favorite | 3 comments


I mean...yes, it could happen like it is outlined in the article. But the easy (and imho proper way to do it completely avoids it: Don't rely on the User-Agent (like: at all) and do proper feature detection client side where you probably need it anyway. This way you also don't have the problem of having to maintain the list of browsers to features.


browser sniffing is bad, but I have seen the browser string used as a means of creating device id's to detect when a user is signing in from a new or different device or was compromised


Natural question is "Does this also apply to .NET Core?" since HttpCapabilitiesProvider does not exist in .NET Core




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: