alt text
Caption
Web dev: What browser is visiting the page?
User agent string:
A screenshot of a browser. The URL bar reads firefox://settings, a button on the URL bar is labelled Netscape, a popup from the button reads: “You’re viewing a secure Opera page”, and the web page title reads “Chrome settings”.
Functionally useless. With the web standardized, we shouldn’t need user agents anyway. It would be more beneficial to ask “do you support X, Y, and Z?”
User agents are useful for checking if the request was made by a (legitimate self-identifying) bot, such as Googlebot.
It could also be used in some specific scenarios where you control the client and want to easily identify your client traffic in request logs.
Or maybe you offer a download on your site and you want to reorder your list to highlight the most likely correct binary for the platform in the user agent.
There are plenty of reasonable uses for user agent that have nothing to do with feature detection.
Aren’t user agents just a plain text header? Couldn’t a malicious agent just spoof a legitimate one?
That’s correct, it is just plain text and it can easily be spoofed. You should never perform an auth check of any kind with the user agent.
In the above examples, it wouldn’t really matter if someone spoofed the header as there generally isn’t a benefit to the malicious agent.
Where some sites get into trouble though is if they have an implicit auth check using user agents. An example could be a paywalled recipe site. They want the recipe to be indexed by Google. If I spoof my user agent to be Googlebot, I’ll get to view the recipe content they want indexed, bypassing the paywall.
But, an example of a more reasonable use for checking user agent strings for bots might be regional redirects. If a new user comes to my site, maybe I want to redirect to a localized version at a different URL based on their country. However, I probably don’t want to do that if the agent is a bot, since the bot might be indexing a given URL from anywhere. If someone spoofed their user agent and they aren’t redirected, no big deal.
It’s called feature detection and it goes a long way back, even before Modernizr popularized it.
Popularized? That gets less than 100k downloads a week
Most developers just write their own feature checks (a lot of detections are just a single line of code) or use a library that polyfills the feature if it’s missing.
The person you’re replying to is right, though. Modernizr popularized this approach. It predates npm, and npm still isn’t their main distribution method, so the npm download numbers don’t mean anything.
Youtube currently (for weeks now) does not work on Firefox, if you don’t use a Firefox user agent. Google doing sketchy things again.
I’ve not run into this issue and use Firefox exclusively with ublock origin
I use Charmeleon, with the effects described above.
So you don’t use Firefox, you mess with Firefox. That’s on you then. Devs can’t be held responsible for you intentionally breaking things. Only do what you know works.