Chrome无头模式访问ekrs.ms.gov.pl被拒及user-agent配置问题咨询

需要对波兰KRS企业信息查询平台进行自动化操作，测试环境使用普通有界面模式运行脚本一切正常，但终端用户侧需要以headless无头模式运行，测试时发现无头模式下访问该站点直接返回错误：The requested URL was rejected. Please consult with your administrator。

Starting ChromeDriver 96.0.4664.45 (76e4c1bb2ab4671b8beba3444e61c0f17584b2fc-refs/branch-heads/4664@{#947}) on port 9515 Only local connections are allowed. Please see ChromeDriver官方安全说明文档 for suggestions on keeping ChromeDriver safe. ChromeDriver was started successfully.

DevTools listening on ws://127.0.0.1:63205/devtools/browser/ffacc4cb-af7c-4157-881d-a8c7db522d30
[1206/145642.826:ERROR:command_buffer_proxy_impl.cc(125)] ContextResult::kTransientFailure: Failed to send GpuControl.CreateCommandBuffer.
[1206/145645.262:INFO:CONSOLE(402)] "The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page.", source: 站点TSPD验证脚本 (402)
[1206/145645.263:INFO:CONSOLE(402)] "The ScriptProcessorNode is deprecated. Use AudioWorkletNode instead.", source: 站点TSPD验证脚本 (402)
[1206/145645.264:INFO:CONSOLE(405)] "The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page.", source: 站点TSPD验证脚本 (405)
[1206/145645.265:INFO:CONSOLE(408)] "The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page.", source: 站点TSPD验证脚本 (408)
[1206/145645.265:ERROR:web_contents_delegate.cc(228)] WebContentsDelegate::CheckMediaAccessPermission: Not supported.
[1206/145645.265:ERROR:web_contents_delegate.cc(228)] WebContentsDelegate::CheckMediaAccessPermission: Not supported.
[1206/145645.306:ERROR:gl_utils.cc(318)] [.WebGL-0000249C00081B00]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels
[1206/145645.467:ERROR:gl_utils.cc(318)] [.WebGL-0000249C00081B00]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels
[1206/145645.564:ERROR:gl_utils.cc(318)] [.WebGL-0000249C00081B00]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels
[1206/145645.652:INFO:CONSOLE(0)] "[.WebGL-0000249C00081B00]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels", source: 站点TSPD验证脚本 (0)
[1206/145645.652:INFO:CONSOLE(0)] "[.WebGL-0000249C00081B00]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels", source: 站点TSPD验证脚本 (0)
[1206/145645.654:INFO:CONSOLE(0)] "[.WebGL-0000249C00081B00]GL Driver Message (OpenGL, Performance, GL_CLOSE_PATH_NV, High): GPU stall due to ReadPixels", source: 站点TSPD验证脚本 (0)

• 已验证无头模式访问被拒的基础解决方法：给浏览器添加自定义user-agent，取值为Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36即可正常访问站点
• 特殊异常现象：如果将user-agent中的Chrome版本号替换为旧版60.0.3112.50，headless模式下可正常导航到站点首页，但不管是无头模式还是普通有界面模式，填写表单提交搜索请求时都会触发同样的访问被拒错误
• 对照验证结果：
  • 未配置自定义user-agent时，普通模式下站点访问和搜索功能都正常
  • 配置版本号为60.0.3112.50的旧版user-agent时，普通模式下可正常访问首页，但搜索功能失效

该现象是站点分层反爬校验机制导致的：

1. 首页仅做基础UA合法性校验，只要UA符合主流浏览器的格式规则就会放行，旧版Chrome的UA仍属于合法浏览器标识，所以可以正常加载首页
2. 搜索接口做了增强级的浏览器指纹校验，会对比UA声明的浏览器版本和实际浏览器的特性支持情况是否匹配：Chrome 60版本本身不支持站点依赖的AudioWorklet、部分WebGL特性，你实际运行的是高版本Chrome，却通过UA声明自己是Chrome 60，校验时就会出现指纹不匹配，被反爬系统判定为异常请求直接拦截
3. 最初无头模式被拦截也是同理，Chrome无头模式默认UA会携带HeadlessChrome标识，被站点基础校验直接识别为自动化工具拦截，替换为普通有界面Chrome的UA即可通过校验

建议自动化运行时，user-agent声明的Chrome大版本和你实际使用的Chrome、ChromeDriver大版本保持完全一致，避免出现指纹不匹配被拦截的问题。

内容的提问来源于stack exchange，提问作者Michał Lipok