title: Duplicate request with `Sec-Fetch-User: ?1` header messes up my request throttling
body: <p>I have a web site and I have implemented my own request throttling for extra security.</p>
  
  <p>The problem is that, from one particular machine, I get duplicate requests, almost identical between them. The two requests are generated with millisecond time-difference between them.</p>
  
  <p>The original request is executed when some JavaScript code submits a form programmatically.</p>
  
  <p>The only difference between them is that the first request has this header defined:</p>
  
  <p><code>Sec-Fetch-User: ?1</code></p>
  
  <p>Based on <a href="https://www.w3.org/TR/fetch-metadata/#sec-fetch-user-header" rel="nofollow noreferrer">this</a> page, it seems that the header means that the 1st request was NOT generated by a user?</p>
  
  <p>The text is quite technical and I could not drill down much into what this <code>?1</code> means.</p>
  
  <p>Can anyone enlighten me? Does it mean that it was generated by a tool and that I can simply deny to serve requests with that header?</p>
  
  <p>Also, this seems to happen from any browser on the device (Win10 OS). Any idea what kind of software is doing this and why?</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>After looking at <a href="https://stackoverflow.com/questions/58493100/testing-with-watir-chromedriver-failed-with-sec-fetch-user-in-request-headers">this</a> question, I tried tested with non-Chromium-based browsers on the same machine and I have the impression that it is not happening on those browsers.</p>
  
  <p>But I wonder why this happens mostly on this particular machine and what is the meaning of this behavior.</p>