If the user agent contains information that could potentially be abused, why would every browser send it to every website?

Question

As far as I've seen, every browser I use have a long User-Agent HTTP header that is as detailed as that it contains specific browser versions (or can be used to accurately deduce browser version, sometimes a little more about the host environment).

Assume there's an either known or 0-day vulnerability of some specific environments that allows a web page to do something wacky, a web server could easily do so by checking the user agent string and send malicious code to only vulnerable clients.

I doubt it's hard to think of other exploits where the UA string plays an important role.

Given that, why would an average browser still send this information to whatever website you visit?

Answer 1

Originally the User-Agent was used to custom code for browser variants, the most common example being the way both HTML and Javascript was implented by Microsoft verses everyone else. Most of this has now been mostly standardized now, although I still occassionally encounter web interfaces that don't work correctly unless IE is used.

It's still used to adjust for things like mobile browsing in order to reformat pages to flow better for phones vice a big screen.

Unfortunately it's also misused in many ways. Microsoft web sites were notorious for sending non-IE browsers in circular link loops. Change the User-Agent in Firefox to say "IE" and suddenly the site worked properly.

User-Agent is also used for statistics, but the necessity of that is in the eye of the beholder. There are many plugins available to make User-Agent say anything, so I'm not sure how useful User-Agent is anymore.