Is there any detectable difference between Browser and programmatic http requests

Is there any way to tell from headers or other data, whether a request is from a browser or non-bro开发者_开发技巧wser program?

The browser is a programmatic HTTP request.
It just happens to have a user in front of it.

Some programmatic HTTP requests won't include a User-Agent header, though.

You could do something fancy, such as sending recorded mouse movements using Javascript and checking them statistically, and the non-browser client can simulate them.

Or you could just use a CAPTCHA.

You could unreliably guess by inspecting user agent and referrer, but both are easily spoofed.

Best way is to use some form of CAPTCHA. That is what they were made to do, differentiate between humans and automated actions.