User-Agent Client Hints: An Alternative to Parsing User-Agent Strings for Browser Information

User-Agent Client Hints:

  • User-Agent Client Hints provide a privacy-preserving and ergonomic way for developers to access information about a user's browser.
  • It allows developers to actively request information about the user's device or conditions instead of parsing it from the User-Agent string.

Background:

  • The User-Agent string was designed in 1996 to specify the product and version of the browser or library.
  • Over time, the User-Agent string has become more complex and can potentially allow for user tracking.

Introducing the new User-Agent Client Hints:

  • User-Agent Client Hints provide a privacy-preserving alternative to the User-Agent string.
  • Developers can request specific client data from the browser and receive it in a controlled and auditable manner.

User-Agent Client Hints from Chromium 89:

  • User-Agent Client Hints have been default enabled in Chrome since version 89.
  • By default, the browser returns information about the browser brand, version, platform, and whether it's a mobile device.

User-Agent response and request headers:

  • The value of User-Agent may be blank, not returned, or populated with a varying value due to privacy and compatibility considerations.
  • The User-Agent information can also be accessed in JavaScript through the navigator.userAgentData object.

Example exchange:

  • A typical exchange between the browser and server involves the browser requesting a page and the server responding with data and requesting additional information.
  • The browser grants the server access to the additional information in subsequent requests.

JavaScript API:

  • The User-Agent information can be accessed in JavaScript through the navigator.userAgentData object.
  • Additional values can be retrieved using the getHighEntropyValues() method.

Privacy and compatibility considerations:

  • User-Agent Client Hints are only sent over secure connections.
  • The value of User-Agent may not always be available or consistent, and developers should account for this in their code.

Hint life-time and resetting:

  • Hints specified via the Accept-CH header will be sent for the duration of the browser session or until a different set of hints are specified.
  • If another Accept-CH header is received, it will completely replace the current hints being sent.

Hint scope and cross-origin requests:

  • By default, Client Hints will only be sent on same-origin requests.
  • To allow hints on cross-origin requests, each hint and origin must be specified by a Permissions-Policy header.

Where to use User-Agent Client Hints?:

  • Refactor any instances where you are parsing the User-Agent header or using JavaScript calls to access the information.
  • Re-examine your use of User-Agent information and replace it with other methods whenever possible.

What happens to the User-Agent string?:

  • The plan is to minimize the ability for covert tracking on the web by reducing the amount of identifying information exposed by the existing User-Agent string.
  • User-Agent Client Hints will eventually reduce the information in the User-Agent string while providing the same high-level browser and version information.

Summary:

  • Accept-CH header specifies hints to be sent by the browser.
  • Hints persist until a different set is specified or the browser is closed.
  • Cross-origin requests require Permissions-Policy header to allow hints.
  • Refactor code to use User-Agent Client Hints instead of parsing User-Agent header.
  • User-Agent string will eventually be reduced to minimize tracking.
Edit

Pub: 13 Oct 2023 00:24 UTC

Views: 44