About Useragent
User agent – Wikipedia
In computing, a user agent is any software, acting on behalf of a user, which “retrieves, renders and facilitates end-user interaction with Web content”. [1] A user agent is therefore a special kind of software agent.
Some prominent examples of user agents are web browsers and email readers. Often, a user agent acts as the client in a client–server system. In some contexts, such as within the Session Initiation Protocol (SIP), the term user agent refers to both end points of a communications session. [2]
User agent identification[edit]
When a software agent operates in a network protocol, it often identifies itself, its application type, operating system, software vendor, or software revision, by submitting a characteristic identification string to its operating peer. In HTTP, [3] SIP, [2] and NNTP[4] protocols, this identification is transmitted in a header field User-Agent. Bots, such as Web crawlers, often also include a URL and/or e-mail address so that the Webmaster can contact the operator of the bot.
Use in HTTP[edit]
In HTTP, the User-Agent string is often used for content negotiation, where the origin server selects suitable content or operating parameters for the response. For example, the User-Agent string might be used by a web server to choose variants based on the known capabilities of a particular version of client software. The concept of content tailoring is built into the HTTP standard in RFC 1945 “for the sake of tailoring responses to avoid particular user agent limitations”.
The User-Agent string is one of the criteria by which Web crawlers may be excluded from accessing certain parts of a website using the Robots Exclusion Standard ( file).
As with many other HTTP request headers, the information in the “User-Agent” string contributes to the information that the client sends to the server, since the string can vary considerably from user to user. [5]
Format for human-operated web browsers[edit]
The User-Agent string format is currently specified by section 5. 5. 3 of HTTP/1. 1 Semantics and Content. The format of the User-Agent string in HTTP is a list of product tokens (keywords) with optional comments. For example, if a user’s product were called WikiBrowser, their user agent string might be WikiBrowser/1. 0 Gecko/1. 0. The “most important” product component is listed first.
The parts of this string are as follows:
product name and version (WikiBrowser/1. 0)
layout engine and version (Gecko/1. 0)
During the first browser war, many web servers were configured to send web pages that required advanced features, including frames, to clients that were identified as some version of Mozilla only. [6] Other browsers were considered to be older products such as Mosaic, Cello, or Samba, and would be sent a bare bones HTML document.
For this reason, most Web browsers use a User-Agent string value as follows:
Mozilla/[version] ([system and browser information]) [platform] ([platform details]) [extensions]
For example, Safari on the iPad has used the following:
Mozilla/5. 0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531. 21. 10 (KHTML, like Gecko) Mobile/7B405
The components of this string are as follows:
Mozilla/5. 0: Previously used to indicate compatibility with the Mozilla rendering engine.
(iPad; U; CPU OS 3_2_1 like Mac OS X; en-us): Details of the system in which the browser is running.
AppleWebKit/531. 10: The platform the browser uses.
(KHTML, like Gecko): Browser platform details.
Mobile/7B405: This is used by the browser to indicate specific enhancements that are available directly in the browser or through third parties. An example of this is Microsoft Live Meeting which registers an extension so that the Live Meeting service knows if the software is already installed, which means it can provide a streamlined experience to joining meetings.
Before migrating to the Chromium code base, Opera was the most widely used web browser that did not have the User-Agent string with “Mozilla” (instead beginning it with “Opera”). Since July 15, 2013, [7] Opera’s User-Agent string begins with “Mozilla/5. 0” and, to avoid encountering legacy server rules, no longer includes the word “Opera” (instead using the string “OPR” to denote the Opera version).
Format for automated agents (bots)[edit]
Automated web crawling tools can use a simplified form, where an important field is contact information in case of problems. By convention the word “bot” is included in the name of the agent. [8] For example:
Googlebot/2. 1 (+)
Automated agents are expected to follow rules in a special file called “”.
User agent spoofing[edit]
The popularity of various Web browser products has varied throughout the Web’s history, and this has influenced the design of websites in such a way that websites are sometimes designed to work well only with particular browsers, rather than according to uniform standards by the World Wide Web Consortium (W3C) or the Internet Engineering Task Force (IETF). Websites often include code to detect browser version to adjust the page design sent according to the user agent string received. This may mean that less-popular browsers are not sent complex content (even though they might be able to deal with it correctly) or, in extreme cases, refused all content. [9] Thus, various browsers have a feature to cloak or spoof their identification to force certain server-side content. For example, the Android browser identifies itself as Safari (among other things) in order to aid compatibility. [10][11]
Other HTTP client programs, like download managers and offline browsers, often have the ability to change the user agent string.
Spam bots and Web scrapers often use fake user agents.
A result of user agent spoofing may be that collected statistics of Web browser usage are inaccurate.
User agent sniffing[edit]
User agent sniffing is the practice of websites showing different or adjusted content when viewed with certain user agents. An example of this is Microsoft Exchange Server 2003’s Outlook Web Access feature. When viewed with Internet Explorer 6 or newer, more functionality is displayed compared to the same page in any other browsers. User agent sniffing is considered poor practice, since it encourages browser-specific design and penalizes new browsers with unrecognized user agent identifications. Instead, the W3C recommends creating standard HTML markup, [12] allowing correct rendering in as many browsers as possible, and to test for specific browser features rather than particular browser versions or brands. [13]
Websites intended for display by mobile phones often rely on user agent sniffing, since mobile browsers often differ greatly from each other.
Encryption strength notations[edit]
Web browsers created in the United States, such as Netscape Navigator and Internet Explorer, previously used the letters U, I, and N to specify the encryption strength in the user agent string. Until 1996, when the United States government allowed encryption with keys longer than 40 bits to be exported, vendors shipped various browser versions with different encryption strengths. “U” stands for “USA” (for the version with 128-bit encryption), “I” stands for “International” – the browser has 40-bit encryption and can be used anywhere in the world – and “N” stands (de facto) for “None” (no encryption). [14] Following the lifting of export restrictions, most vendors supported 256-bit encryption.
[edit]
In 2020, Google announced that they would be phasing out support for the User-Agent header in their Google Chrome browser. They stated that other major web browser vendors were supportive of the move, but that they did not know when other vendors would follow suit. [15] Google stated that a new feature called Client Hints would replace the functionality of the User-Agent string. [16]
See also[edit]
Robots exclusion standard
Web crawler
Wireless Universal Resource File (WURFL)
User Agent Profile (UAProf)
Browser sniffing
Web browser engine
References[edit]
^ “W3C Definition of User Agent”.. 16 June 2011. Retrieved 2018-10-20.
^ a b RFC 3261, SIP: Session Initiation Protocol, IETF, The Internet Society (2002)
^ RFC 7231, Hypertext Transfer Protocol (HTTP/1. 1): Semantics and Content, IETF, The Internet Society (June 2014)
^ Netnews Article Format. IETF. November 2009. sec. 3. 2. 13. doi:10. 17487/RFC5536. RFC 5536.
^ Eckersley, Peter (27 January 2010). “Browser Versions Carry 10. 5 Bits of Identifying Information on Average”. Electronic Frontier Foundation. Retrieved 25 August 2011.
^ History of the browser user-agent string. WebAIM.
^ “Opera User Agent Strings: Opera 15 and Beyond”. 15 July 2013. Retrieved 2014-05-05.
^ ”
^ Burstein complaining “… I’ve been rejected until I come back with Netscape”
^ “Android Browser Reports Itself as Apple Safari”. Archived from the original on August 6, 2011. Retrieved August 9, 2011.
^ “User Agent String explained: Android Webkit Browser”. Retrieved 29 July 2012. Mozilla/5. 0 (Linux; U; Android 2. 2; en-sa; HTC_DesireHD_A9191 Build/FRF91) AppleWebKit/533. 1 (KHTML, like Gecko) Version/4. 0 Mobile Safari/533. 1
^ Pemberton, Stephen. “W3C Markup Validation Service”. W3C. Retrieved 2011-10-18.
^ Clary, Bob (10 February 2003). “Browser Detection and Cross Browser Support”. Mozilla Developer Center. Mozilla. Retrieved 2009-05-30.
^ Zawinski, Jamie (28 March 1998). “user-agent strings (obsolete)”. Retrieved 2010-01-08.
^ “Chrome Phasing out Support for User Agent”. InfoQ. Retrieved 2020-03-25.
^ Cimpanu, Catalin. “Google to phase out user-agent strings in Chrome”. ZDNet. Retrieved 2020-03-25.
Is getting users OS from user agent reliable? – Stack Overflow
So currently on my website I log users OS when they register an account. And then they can view it (their OS that was logged upon registration) on their “account page”.
But my question is, is getting users OS from parsing useragent in PHP reliable? For example I get users useragent via this $_SERVER[‘HTTP_USER_AGENT’] in php, then parse it to extract their OS from the useragent. Can I rely on this being accurate for legitimate users?
I don’t really care if hackers can spoof the useragent, all I really am wondering is if this ($_SERVER[‘HTTP_USER_AGENT’]) will give me the users accurate OS from legitimate (non hacker) site visitors?
Al Foиce ѫ3, 89711 gold badges35 silver badges45 bronze badges
asked Oct 3 ’16 at 6:15
You appear to be asking whether you can trust this field to be reliable when it’s reliable? Well, yes, you can; when it’s reliable, it’s reliable.
But these times are rare. You don’t need to be a “hacker” to spoof a User Agent. A simple browser extension will do it, or one extra argument in your wget or curl command if the request is scripted.
User agent is 100% fallible and you should not rely on it for anything useful.
answered Oct 3 ’16 at 17:17
Yes its reliable for non hacker user.
More Explaination
The user agent string is a text that the browsers themselves send to the webserver to identify themselves, so that websites can send different content based on the browser or based on browser compatibility.
Mozilla is a browser rendering engine (the one at the core of Firefox) and the fact that Chrome and IE contain the string Mozilla/4 or /5 identifies them as being compatible with that rendering engine.
You can also use get_browser() function of php.
answered Oct 3 ’16 at 6:25
shubham715shubham7153, 2601 gold badge13 silver badges26 bronze badges
Most of the time it is pretty reliable, in that most people can’t be bothered to change this information. So using it for purely secondary, and ease-of-use, functionality is OK.
Especially in cases like these, where you use it to fill out the “default” values. Which the user have an option to change if wrong.
However, as it can be changed/spoofed by anyone who knows a little bit about HTTP and/or web browsers, you must not rely upon it for anything security related. There are quite a few browsers even, which will let the user change their user-agent string at will.
That includes using the user-agent string in an attempt to identify a user. As it is trivially easy to copy the headers, and spoof your own.
Use of SSL would increase the difficulty slightly. Still, in order to get all of the headers from your users (or admins), all an attacker would need is to post a link on your site to a server of his own. After which he could do whatever he wanted with his own.
answered Oct 3 ’16 at 6:26
ChristianFChristianF2, 0087 silver badges14 bronze badges
If you want to make your UI more friendly. Lets say: “Is user on Chromer? ” then show him some usefull info. Then its 100% reliable and very usefull. I don’t care how friendly my UI is for hackers.
In some cases, for example… lets say that for some reason you would like to block every one but Chrome owner,.. you can’t rely on it.
answered Mar 18 ’20 at 21:15
Not the answer you’re looking for? Browse other questions tagged php parsing operating-system user-agent or ask your own question.
User Agent Strings – Chrome Developers
Published on Friday, February 28, 2014A browser’s user agent string (UA) helps identify which browser is being used, what version, and on which operating system. When feature detection APIs are not available, use the UA to customize behavior or content to specific browser all other browsers, Chrome for Android sends this information in the User-Agent HTTP header every time it makes a request to any site. It’s also available in the client through JavaScript using the erAgent call. Chrome for AndroidChrome for Android reports its UA in the following formats, depending on whether the device is a phone or a UA:Mozilla/5. 0 (Linux; {Android Version}; {Build Tag etc. })
AppleWebKit/{WebKit Rev} (KHTML, like Gecko)
Chrome/{Chrome Rev} Mobile Safari/{WebKit Rev}Tablet UA:Mozilla/5. })
Chrome/{Chrome Rev} Safari/{WebKit Rev}Here’s an example of the Chrome user agent string on a Galaxy Nexus:Mozilla/5. 0 (Linux; Android 4. 0. 4; Galaxy Nexus Build/IMM76B) AppleWebKit/535. 19 (KHTML, like Gecko) Chrome/18. 1025. 133 Mobile Safari/535. 19If you are parsing user agent strings using regular expressions, the following can be used to check against Chrome on Android phones and tablets:Phone pattern: ‘Android’ + ‘Chrome/[. 0-9]* Mobile’Tablet pattern: ‘Android’ + ‘Chrome/[. 0-9]* (?! Mobile)’ Chrome for iOSThe UA in Chrome for iOS is the same as the Mobile Safari user agent, with CriOS/
AppleWebKit/602. 1. 50 (KHTML, like Gecko) CriOS/56. 2924. 75
Mobile/14E5239e Safari/602. 1For comparison, the Mobile Safari UA:Mozilla/5. 0 (iPhone; CPU iPhone OS 10_3 like Mac OS X)AppleWebKit/603. 23 (KHTML, like Gecko)Version/10. 0 Mobile/14E5239e Safari/602. 1Up to Chrome 84, when the Request Desktop Site feature is enabled, the Desktop Safari UA is sent:Mozilla/5. 0 (Macintosh; Intel Mac OS X 10_10_4)AppleWebKit/600. 7. 12 (KHTML, like Gecko)Version/8. 7 Safari/600. 12Starting from Chrome 85, when the Request Desktop Site feature is enabled, the UA is the same as the Desktop Safari UA with CriOS/
AppleWebKit/537. 36 (KHTML, like Gecko)
Version/4. 0 Chrome/30. 0 Mobile Safari/537. 36If you’re attempting to differentiate between the WebView and Chrome for Android, you should look for the presence of the Version/_X. X_ string in the WebView user-agent string. Don’t rely on the specific Chrome version number (for example, 30. 0) as the version numbers changes with each release. WebView UA in Lollipop and AboveIn the newer versions of WebView, you can differentiate the WebView by looking for the wv field as highlighted zilla/5. 0 (Linux; Android 5. 1; Nexus 5 Build/LMY48B; wv)
Version/4. 0 Chrome/43. 2357. 65 Mobile Safari/537. 36Last updated: Friday, February 28, 2014 • Improve article
Frequently Asked Questions about about useragent
How reliable is Useragent?
Yes its reliable for non hacker user. The user agent string is a text that the browsers themselves send to the webserver to identify themselves, so that websites can send different content based on the browser or based on browser compatibility.Oct 3, 2016
What is Android Useragent?
A browser’s user agent string (UA) helps identify which browser is being used, what version, and on which operating system. … Like all other browsers, Chrome for Android sends this information in the User-Agent HTTP header every time it makes a request to any site.Feb 28, 2014
What is browser Useragent?
Essentially, a user agent is a way for a browser to say “Hi, I’m Mozilla Firefox on Windows” or “Hi, I’m Safari on an iPhone” to a web server. The web server can use this information to serve different web pages to different web browsers and different operating systems.Sep 13, 2017
