rkh/rack-protection — pull request #73 by rennex (2014-01-03 03:23:33+00:00)
Title: Ignore changing Accept-Encoding header, fixes #56

In this pull request, I've done the bare minimum changes to fix issue #56 when it comes to `` and `` tags -- removed tracking of the Accept-Encoding header.

But as I stated in the thread on that issue, in my opinion this whole SessionHijacking protection is ill-advised, and I'd like to suggest removing it. It is **trivial** for an attacker to circumvent, and prone to other false positives in the future (there's no telling if a normally operating browser decides to prefer other languages for different URLs or different types of media). Also, browser are updated frequently and that changes the User-Agent string, effectively logging users out of any sites using this protection, even if the login isn't supposed to expire in months.