webfan@inne.city

@pasjrwoctx

cookie could be faked but so can headers, and the way I have it now the cookie is only good for the session, bots and scrapers start a new session every time

The sessionID is in the cookie yes, but the info can be in the session. If a bad bot starts a new session, well it will not have the "OK" in the session.
Accept headers can be faked but that would make less sense as it breaks content negotiation, and you can use it as ONE aspect of other bot indicators.

, but my understanding of how friendica and activitypub are setup the inbox should not be callable by bots and scrapers

For server to server protocol an instance will act like a "legitim bot", it will not pass a captcha or session check, validation of the request is done via signatures.

@pasjrwoctx Sorry, I mean the /inbox route from the check

$is_fediverse =
str_contains($request, '/.well-known/') ||
str_contains($request, '/activitypub/') ||
str_contains($request, '/api/') ||
str_contains($request, '/assets/') ||
str_contains($request, '/inbox');

You could also check for Request-Type headers.

A cookie can be faked, you should consider to store the OK in the session instead?

@catmanfriedhelm Ich fand das auch erst etwas verwirrend.

Folgende sind die die mir folgen und Gefolgte denen folge ich richtig?

Ich glaube ja.