Unverified50% confidenceFactExact time
The User-Agent field in HTTP requests is declared by the client itself; the HTTP protocol has not introduced any authentication mechanism for this field, and anyone can freely forge it.
1
Sources
50%
Confidence
Long-term
Relevance
8/14/2026
First Seen
Sources
黑客伪装ClaudeBot发起大规模漏洞扫描：识别与防御指南
Related Claims
Unverified企业系统鉴权中，Token 通常以 Authorization: Bearer <token> 的形式携带在 HTTP 请求头中70% similarUnverified恶意站点可利用伪造的OAuth授权请求，在真实页面上诱导用户授权，从而无需获取密码即可控制账号65% similarUnverifiedBSK复用用户真实登录身份，Agent操作等同于以用户身份在网站上行动，网站无法区分手动操作还是Agent自动化63% similarUnverifiedWebAuthn 在注册时会将服务域名（Origin）与密钥绑定，使得仿冒域名的钓鱼网站无法触发合法签名62% similarUnverifiedThe core purpose of the API signature mechanism is to prevent request tampering and unauthorized access.62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/747728API
curl https://kongchang.com/api/v1/knowledge/claims/747728MCP
get_claim(id=747728)