3

As far as I've seen, every browser I use have a long User-Agent HTTP header that is as detailed as that it contains specific browser versions (or can be used to accurately deduce browser version, sometimes a little more about the host environment).

Assume there's an either known or 0-day vulnerability of some specific environments that allows a web page to do something wacky, a web server could easily do so by checking the user agent string and send malicious code to only vulnerable clients.

I doubt it's hard to think of other exploits where the UA string plays an important role.

Given that, why would an average browser still send this information to whatever website you visit?

2
  • To let web server customize the response based on the browser making the request. Apr 5, 2019 at 16:08
  • See User Agent Client Hints for a proposal for an alternative.
    – Sjoerd
    Apr 5, 2019 at 16:10

1 Answer 1

2

Originally the User-Agent was used to custom code for browser variants, the most common example being the way both HTML and Javascript was implented by Microsoft verses everyone else. Most of this has now been mostly standardized now, although I still occassionally encounter web interfaces that don't work correctly unless IE is used.

It's still used to adjust for things like mobile browsing in order to reformat pages to flow better for phones vice a big screen.

Unfortunately it's also misused in many ways. Microsoft web sites were notorious for sending non-IE browsers in circular link loops. Change the User-Agent in Firefox to say "IE" and suddenly the site worked properly.

User-Agent is also used for statistics, but the necessity of that is in the eye of the beholder. There are many plugins available to make User-Agent say anything, so I'm not sure how useful User-Agent is anymore.

1
  • Mobile viewing/responsive design should be done on the client side using CSS, meaning there is no custom response by the servers (regarding the view) for mobile devices Apr 5, 2019 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .