- 且沒有送出任何身分驗證憑證

這種攻擊主要與以下情境相關：

- 應用在本機（例如 `localhost`）或內部網路中執行
- 並且應用沒有任何身分驗證，假設同一個網路中的任何請求都可被信任

## 攻擊範例 { #example-attack }

假設你打造了一個在本機執行 AI 代理（AI agent）的方法。

它提供一個 API：

```
http://localhost:8000/v1/agents/multivac
```

同時也有一個前端：

```
http://localhost:8000
```

/// tip | 提示

請注意兩者的主機（host）相同。

///

接著你可以透過前端讓 AI 代理代你執行動作。

//   - Capacity Reporting
//   - Backup data locality for upload sessions (Veeam Smart Entity)
//   - Handover of IAM & STS Endpoints instead of manual definition in Veeam Backup & Replication. This allows Veeam
//     Agents to directly backup to object storage.
//
// An object storage system can implement one, multiple, or all functions.
//
//   - Optional (mandatory if <IAMSTS> is true): Set Endpoints for IAM and STS processing.
//

    // ============================================================
    // User Agent Configuration
    // ============================================================

    /** Prefix for Fess crawler user agent string. */
    public static final String CRAWLING_USER_AGENT_PREFIX = "Mozilla/5.0 (compatible; Fess/";

    /** Suffix for Fess crawler user agent string with bot information URL. */

  @Test fun ofMapAcceptsEmptyValue() {
    val headers = mapOf("User-Agent" to "").toHeaders()
    assertThat(headers.value(0)).isEqualTo("")
  }

  @Test fun ofMapTrimsKey() {
    val headers = mapOf(" User-Agent " to "OkHttp").toHeaders()
    assertThat(headers.name(0)).isEqualTo("User-Agent")
  }

  @Test fun ofMapTrimsValue() {
    val headers = mapOf("User-Agent" to " OkHttp ").toHeaders()

     * Set to -1 to disable automatic purging of user information.
     */
    @Min(-1)
    @Max(100000)
    @ValidateTypeFailure
    public Integer purgeUserInfoDay;

    /**
     * Bot user agents whose search logs should be purged.
     * Search logs from these bots will be automatically removed.
     */
    @Size(max = 10000)
    public String purgeByBots;

    /**

      label: "What is the URL of the page with the issue?"
    validations:
      required: true
  - type: input
    id: user-agent
    attributes:
      label: "What is your user agent?"
      description: "You can find your user agent here: https://www.google.com/search?q=what+is+my+user+agent"
    validations:
      required: true
  - type: textarea
    id: screenshot
    attributes:
      label: "Screenshot"

* SSE - [Server-sent events](https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events)

Where the spec is ambiguous, OkHttp follows modern user agents such as popular Browsers or common HTTP Libraries.

OkHttp is principled and avoids being overly configurable, especially when such configuration is

    }

    /** The HTTP header name for User-Agent */
    protected static final String USER_AGENT = "user-agent";

    /** The request attribute key for storing cached user agent type */
    protected static final String USER_AGENT_TYPE = "ViewHelper.UserAgent";

    /**
     * Determines the user agent type from the current HTTP request.
     * The method analyzes the User-Agent header to categorize the browser type

     permission java.lang.RuntimePermission "accessDeclaredMembers";
     permission java.util.PropertyPermission "intellij.debug.agent", "read";
     permission java.util.PropertyPermission "intellij.debug.agent", "write";
     permission org.bouncycastle.crypto.CryptoServicesPermission "exportSecretKey";
     permission org.bouncycastle.crypto.CryptoServicesPermission "exportPrivateKey";

OkHttpClient client = new OkHttpClient.Builder()
    .addInterceptor(new LoggingInterceptor())
    .build();

Request request = new Request.Builder()
    .url("http://www.publicobject.com/helloworld.txt")
    .header("User-Agent", "OkHttp Example")
    .build();

Response response = client.newCall(request).execute();
response.body().close();
```