Akamai _abck: the cookie that rewrites itself on every response
Akamai Bot Manager is the one anti-bot product where the cookie is the least interesting part of the story. Everyone fixates on _abck . What actually decides whether your next request passes is the sequence of updates _abck went through — and the headers that came back with it. This post is about three things that break Akamai automation in practice: treating _abck as a one-time token, discarding bm_sz and ak_bmsc because _abck looks like the important one, and ignoring solution.headers because no other solver returns any. Scope: everything below is for QA automation on properties you are authorised to test. Three cookies, three jobs Akamai hands out cookies in layers, and each one answers a different question. ak_bmsc — the anonymous browser session. It is issued before any sensor data runs, it is short-lived, and on its own it gets you a page, not an API. bm_sz — the session marker that pairs with _abck . They are set together and they are checked together. A request carrying...