curl as ground truth

When it applies

Any time you need to know what a server actually returns — no proxy magic, no scanner interpretation — or when automated tooling is being blocked at a CDN/WAF edge and you suspect the request shape, not the content, is the problem. Typical trigger: bare curl or a datacenter UA gets 403 with a JSON access-policy body or a CF-RAY header, while the same endpoint works in a real browser.

Why it works

Edge protection (Cloudflare & friends) classifies clients by TLS/HTTP fingerprints and headers. A request carrying a browser User-Agent plus plausible Origin/Referer/Sec-Fetch-* headers often sails through where a naked curl gets challenged — and unlike a scanner, curl shows you the exact bytes that came back.