Skip to main content
Information Security

Return to Question

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

A service I use has decided to block HTTP requests that do not provide a UserAgent, citing security reasons.

As far as I can tell, the UserAgent is a string without a standard format used primarily for statistics, serving different page versions (eg mobile), and blocking bots. The RFC says it SHOULD (but not MUST) be sent.

Why Shellshock works in useragent string?Why Shellshock works in useragent string? suggests that a malicious UserAgent could be constructed, but the service is blocking requests without a UserAgent.

Is there a vulnerability around absent UserAgent headers I'm not aware of?

A service I use has decided to block HTTP requests that do not provide a UserAgent, citing security reasons.

As far as I can tell, the UserAgent is a string without a standard format used primarily for statistics, serving different page versions (eg mobile), and blocking bots. The RFC says it SHOULD (but not MUST) be sent.

Why Shellshock works in useragent string? suggests that a malicious UserAgent could be constructed, but the service is blocking requests without a UserAgent.

Is there a vulnerability around absent UserAgent headers I'm not aware of?

A service I use has decided to block HTTP requests that do not provide a UserAgent, citing security reasons.

As far as I can tell, the UserAgent is a string without a standard format used primarily for statistics, serving different page versions (eg mobile), and blocking bots. The RFC says it SHOULD (but not MUST) be sent.

Why Shellshock works in useragent string? suggests that a malicious UserAgent could be constructed, but the service is blocking requests without a UserAgent.

Is there a vulnerability around absent UserAgent headers I'm not aware of?

Source Link
Holly
Holly
  • 143
  • 1
  • 1
  • 4

Are requests with no UserAgent header a risk?

A service I use has decided to block HTTP requests that do not provide a UserAgent, citing security reasons.

As far as I can tell, the UserAgent is a string without a standard format used primarily for statistics, serving different page versions (eg mobile), and blocking bots. The RFC says it SHOULD (but not MUST) be sent.

Why Shellshock works in useragent string? suggests that a malicious UserAgent could be constructed, but the service is blocking requests without a UserAgent.

Is there a vulnerability around absent UserAgent headers I'm not aware of?