I have recently come across some logs in my application where I have seen the user's browser agent info being switched. Even if the user is using the same browser, the agent info has been modified for consecutive requests.
For example, a request from the user came from
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0)
But the user hasn't changed his/her browser, and the browser info was:
Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/7.0)
If I cannot even rely on the browser agent info, what is the ideal way to confirm that the browser agent has/hasn't been changed?
Problem I am trying to solve
Session fixation problem - I am trying to detect when a user does the following:
1) Grabs request headers belonging to an authenticated session. 2) Goes to another computer in a different location (e.g. different computer/browser). 3) Fires a new request with the same headers from the authenticated session and receives a successful response with resources (e.g. file/page with private data).
I originally tried to solve it with IP address and Browser agent checks - but I realised that due to NAT switching IP address check is totally impractical. Now it looks like browser-agent check is also not good.