Does checking the UA string offer much security? I've always been under the impression that it's essentially user input and not to be trusted. But yeah, that is a pretty nasty CSRF. Good post, thanks.
As you said, checking the User-Agent does not offer much security, but at this point, is more than nothing. I know that Instagram team are studying other ways (csrftoken among others) to protect their website or application against this kind of attacks. Thanks.
For a CSRF attack it actually does because it needs to be executed inside an unsuspecting victim's browser. That wouldn't be sending an custom Instagram user-agent.
