Comments on: What’s a Browser User-Agent String?

By: Dave H.

Dave H. — Mon, 20 Apr 2009 14:37:57 +0000

“None of these things are something that should be hidden, or covered up.” – Hmmm, I’d have to disagree there, true if the site visited is Mostly Harmless, but a malicious site will tailor its exploits to the browsers’ vulnerabilities – there’s also a server agent string that comes back, think unpatched IIS for what a scriptkiddie could do with that info.

A number of web cache / load balancing devices rewrite the UAS to help get around this (think of the ISP hosting colo sites, where customer servers may be running any server on any platform), forcing strict HTTP and returning a null or garbage (or even the name of the appliance vendor’s kit, hopefully they won’t have exploits for security devices…) for the server agent – helpful in an environment where security counts!

By: Philippe Azimzadeh

Philippe Azimzadeh — Sat, 18 Apr 2009 16:52:41 +0000

UserAgentString.com thinks that Safari 4 is a Mozzila based browser, and it also says “like Gecko” whatever that means.

By: Brenton

Brenton — Sat, 18 Apr 2009 16:46:43 +0000

The best and funniest explanation of user agent strings anywhere is here: http://webaim.org/blog/user-agent-string-history/

But seriously, detecting the browser based on user agent string doesn’t work. It’s actually bad for your website and can make some people unable to view your site.

By: iTuner99

iTuner99 — Sat, 18 Apr 2009 13:09:49 +0000

Nice to know info especially from my iPhone which it confirmed has strong security.

By: Dondrey

Dondrey — Sat, 18 Apr 2009 04:09:43 +0000

Makes perfect sense to me….how else would browsers figure out configurations