服务器如何区分浏览器发起与API发起的登录请求？

Great question! This is a super common scenario when building web apps that serve both human users via browsers and programmatic clients via APIs. Let me break down the key ways servers tell these two login request types apart:

• Request Headers (the primary differentiator)

  • User-Agent: Browsers send a detailed header identifying themselves, like Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36. API clients (Postman, axios, custom scripts) will have a distinct User-Agent—think PostmanRuntime/7.36.3 or MyMobileApp/2.1.0.
  • Accept: Browsers typically request text/html first (since they need to render a webpage), while API clients almost always specify application/json (or application/xml) to ask for structured data instead of a UI.

• Request Body Content-Type

  • Browser form submissions default to application/x-www-form-urlencoded (encoding username/password as key-value pairs like username=johndoe&password=secret) or multipart/form-data for file uploads.
  • API requests usually send data as application/json, with a body like {"username": "johndoe", "password": "secret"}.

• Authentication & Response Behavior

  • For browser logins, servers typically set HTTP-only session cookies to persist the user's session. On successful login, the server will send a 302 Redirect to the user's dashboard or homepage.
  • API logins expect token-based authentication (like JWT). Instead of a redirect, the server returns a JSON response with a token (e.g., {"access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."}). Clients then store this token and send it in the Authorization: Bearer <token> header for subsequent requests.

• Intentional Endpoint Separation

  • Many developers eliminate ambiguity entirely by building separate endpoints. For example:
    • Browser login: /login (returns HTML or redirects on success)
    • API login: /api/v1/auth/login (returns JSON token)
  • This is the most reliable method, as it removes any guesswork from the server's side.

• Secondary Clues

  • Referer Header: Browser requests often include a Referer header showing which page the user came from (e.g., /home). API requests rarely have this, or it points to a tool internal URL.
  • Custom Headers: Some API clients send custom headers like X-Requested-With: XMLHttpRequest (classic AJAX marker) or X-Client-Type: API to explicitly identify themselves.

In practice, servers often use a mix of these checks. For example, if a request to /login has an Accept: application/json header, the server might switch to API mode and return a token instead of redirecting. Endpoint separation, though, is the cleanest way to avoid edge cases.

内容的提问来源于stack exchange，提问作者Owais