How can we detect web request vs non-web (backend/curl/etc)?
I'm currently using the
origin header as part of our access control strategy but realized this header can be set via non-web clients. Is there a strategy to detect requests coming from the web vs curl-type or backend environments?
