Limit access to VIP or VS only from browser

you can try to detect user-agent

when HTTP_REQUEST {
  switch -glob -- [string tolower [HTTP::header "User-Agent"]] {
    "*microsoft office *ios*" -
    "*onedriveiosapp*" -
    "onedrive/*darwin*" {
      Mobile Office Apps
      HTTP::respond 403 -version "1.1" content {Access Denied.} noserver "Content-Type" "text/html" 
      return
    }
    "*microsoft office onedrive*" -
    "*microsoft onedrive*" -
    "*microsoft office skydrive*" -
    "*microsoft office syncproc*" -
    "*microsoft office upload center*" -
    "*office protocol discovery*" -
    "*microsoft office*" -
    "*microsoft data access internet publishing provider*" -
    "*non-browser*" -
    "msoffice 12*" -
    "*microsoft-webdav-miniredir*" -
    "*ms frontpage*" {
      Desktop Office Apps
      HTTP::respond 403 -version "1.1" content {Access Denied.} noserver "Content-Type" "text/html" 
      return
    }
    "*mozilla*" -
    "*opera*" {
         Regular web browser detected.  
        
    }
    default { 
        All others
      HTTP::respond 403 -version "1.1" content {Access Denied.} noserver "Content-Type" "text/html" 
      return
    }
  }
}

But, any command line can change his user-agent header to bypass this code.