add user agent to coingecko exchange source request
What the developer wrote
Authored by Craig Raw
add user agent to coingecko exchange source request
What changed, and why it matters
This commit changes how Sparrow Wallet asks CoinGecko for currency exchange rates. It now sends a fake web-browser 'User-Agent' header instead of none. This is likely a workaround because CoinGecko started blocking or rate-limiting requests that had no user agent. It is not a fix for a vulnerability in Sparrow itself, but it does make Sparrow's exchange-rate requests slightly more identifiable and could affect privacy if the same user agent is reused elsewhere.
No immediate security action required. If privacy is a concern, consider randomizing or rotating the User-Agent rather than using a single hard-coded value, and confirm CoinGecko's terms of service allow this access pattern.
Security signals we found
Hard-coded User-Agent string may reduce request anonymity
No input validation or cryptographic change
No authentication or authorization change
No vendor security disclosure present in commit
Evidence from the diff
ExchangeSource.java is updated to pass a hard-coded Map of HTTP headers to HttpClientService.requestJson when fetching CoinGecko rates. Previously the headers argument was null. The added headers are User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; Windows NT 6.1) and Accept: /. This is a compatibility/anti-blocking change, not a security patch. There is no evidence in the commit of a CVE, bug report, or security disclosure.
Changed components
src/main/java/com/sparrowwallet/sparrow/net/ExchangeSource.javaCoinGecko exchange rate retrievalInspect captured patch +2 / −1
diff --git a/src/main/java/com/sparrowwallet/sparrow/net/ExchangeSource.java b/src/main/java/com/sparrowwallet/sparrow/net/ExchangeSource.java
index 3a11f5c..7b01ac3 100644
--- a/src/main/java/com/sparrowwallet/sparrow/net/ExchangeSource.java
+++ b/src/main/java/com/sparrowwallet/sparrow/net/ExchangeSource.java
@@ -3,6 +3,7 @@ package com.sparrowwallet.sparrow.net;
import com.fasterxml.jackson.annotation.JsonAnyGetter;
import com.fasterxml.jackson.annotation.JsonAnySetter;
import com.sparrowwallet.sparrow.AppServices;
+import com.sparrowwallet.sparrow.SparrowWallet;
import com.sparrowwallet.sparrow.event.ExchangeRatesUpdatedEvent;
import com.sparrowwallet.tern.http.client.HttpResponseException;
import javafx.concurrent.ScheduledService;
@@ -151,7 +152,7 @@ public enum ExchangeSource {
HttpClientService httpClientService = AppServices.getHttpClientService();
try {
- return httpClientService.requestJson(url, CoinGeckoRates.class, null);
+ return httpClientService.requestJson(url, CoinGeckoRates.class, Map.of("User-Agent", "Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)", "Accept", "*/*"));
} catch(Exception e) {
if(log.isDebugEnabled()) {
log.warn("Error retrieving currency rates", e);
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.