The user agent is... well, the user's agent. It runs code fetched from a trustworthy origin (your server), so it is not enemy territory.
It holds the session keys. It decides what can or cannot happen after the user clicks on a link with some funny URL in an e-mail. It displays and processes data entered by less trustworthy users. If anyone can just make it insert random HTTP headers, this could be a problem.
Yes, the server must assume that enemy agents also exist. But it should better not deliver one to all users.
It holds the session keys. It decides what can or cannot happen after the user clicks on a link with some funny URL in an e-mail. It displays and processes data entered by less trustworthy users. If anyone can just make it insert random HTTP headers, this could be a problem.
Yes, the server must assume that enemy agents also exist. But it should better not deliver one to all users.