Mimicking Chrome's TLS handshake cut web request refusals by 38% in study

·1 views

A developer tested how websites respond to three types of HTTP clients across 500 domains using servers in New York, Frankfurt, and Singapore. Honest Python requests were refused 35.1% of the time, while adding a Chrome user-agent string dropped refusals to 26.9%, and fully copying Chrome's TLS handshake reduced them further to 20.2%. Eighteen domains, including Facebook, WordPress, Cisco, and W3.org, consistently blocked the Python-handshake client but served the Chrome-fingerprinted one across all three regions. Notably, W3.org — which publishes the HTTP and TLS specifications — refused a standards-compliant Python client until it mimicked Chrome's handshake. The researcher noted that IP address reputation acts as a separate, deeper filter that TLS fingerprint mimicry alone cannot bypass.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why Unprotected MCP Servers Are a Security Risk for AI Agents

Model Context Protocol (MCP) has become a widely adopted standard for connecting AI agents to tools, APIs, and databases, but most MCP servers are deployed without authentication, authorization, rate limiting, or audit logging. Without a gateway layer, any agent that reaches an MCP server's port can invoke every available tool, making it impossible to track who called what or enforce per-tool permissions. Malicious content in an agent's context window can also trigger prompt injection attacks, manipulating the agent into taking unintended actions. Kong AI Gateway 2.0, available through Kong Konnect, addresses these gaps by introducing dedicated entities such as AI MCP Servers, AI Consumers, AI Auth Strategies, and AI Policies. The platform replaces older plugin-based approaches from Kong Gateway 3.x and provides declarative configuration to enforce authentication, tool-level authorization, rate limiting, and full audit trails for every AI agent interaction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build an Accessible SaaS Pricing Page Using Native Radio Buttons

A best-practice guide for SaaS pricing pages recommends using native HTML radio buttons grouped inside a fieldset element, rather than custom div-based controls. Each pricing plan card acts as a label wrapping its radio input, allowing users to select a plan by clicking anywhere on the card while retaining full keyboard and assistive-technology support. Visual styling such as border changes and background highlights should complement — not replace — the underlying form behavior, ensuring the page works even if CSS or JavaScript fails. Plan cards should clearly display cost, billing period, target user, and key feature differences without hiding critical details in tooltips. Server-side validation of the submitted plan value is also advised, since browser input should always be treated as untrusted data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Security Review Flags Six Critical Upgrade Vulnerabilities in $5.7B SparkLend

A technical security assessment of SparkLend, a decentralized lending protocol with $5.7 billion in total value locked across Ethereum and multiple Layer 2 networks, has identified six critical vulnerabilities in its upgrade architecture. The review, dated September 24, 2026, was conducted by a senior DeFi security researcher examining proxy patterns, storage layouts, and governance pathways rather than the protocol's core lending logic. Among the most severe findings are storage-slot misalignments between Ethereum and L2 implementations that could silently corrupt user balances and collateral ratios during an upgrade. Auditors also flagged a governance bypass flaw in the UpgradeController that allows any address to execute proposals before the 48-hour timelock expires, potentially enabling immediate deployment of malicious code. The protocol received an overall risk score of 7 out of 10, with reviewers noting that while its core economic logic is sound, the upgrade surface poses a significant threat to a large portion of user funds.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Seven Workplace Strategies to Handle a Toxic Manager, Inspired by Schopenhauer

A software engineer writing for DEV Community draws on philosopher Arthur Schopenhauer's ideas about will and reason to outline seven behavioral rules for dealing with toxic managers. The author argues that logic alone fails against manipulative leadership because such managers operate on emotional scripts rather than rational debate. Three common toxic archetypes are identified — the Caregiver, the Victim, and the Inquisitor — each using distinct tactics to exploit or destabilize subordinates. Key strategies include withholding emotional reactions, guarding personal vulnerabilities, and allowing toxic leaders to expose themselves over time rather than confronting them directly. The framework reframes workplace survival not as conflict but as deliberate, low-visibility self-protection.

0 comments Read more at DEV Community