Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

If omit the user-agent string or, even better, the user-agent header itself, everything will be fine, too.

Tested with Cloudflare and many, many other servers over many years.

On the whole, taking the entire web into account, it is rare for a user-agent string to be required.

However, it has become common for servers to make many assumptions based on user-agent strings.

I would guess there are many tech workers whose entire job rests on the assumption that user-agent strings are always present, rarely manipulated^1 and accurately represent the user's hardware and software.

1. For example, changed using "Developer Tools" in the major browsers. Google's browser has some user-agent presets for "testing" in DevTools (Ctrl-Shift I, Ctrl-Shift P, Drawer Show Network Conditions). Those should be safe to use for logins to Google websites. Try them out, e.g., when logging into Gmail and watch how the user can request vastly different web page styles based only on user-agent string.



There are a number of sites that simply crash with a web framework backtrace or behave strangely when the User-Agent header is not sent.


That sounds like something worth reporting if possible, assuming it's also written to a log it might be a denial of service week point.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: