User-Agent Client Hints: An Alternative to Parsing User-Agent Strings for Browser Information
User-Agent Client Hints:
- User-Agent Client Hints provide a privacy-preserving and ergonomic way for developers to access information about a user's browser.
- It allows developers to actively request information about the user's device or conditions instead of parsing it from the User-Agent string.
Background:
- The User-Agent string was designed in 1996 to specify the product and version of the browser or library.
- Over time, the User-Agent string has become more complex and can potentially allow for user tracking.
Introducing the new User-Agent Client Hints:
- User-Agent Client Hints provide a privacy-preserving alternative to the User-Agent string.
- Developers can request specific client data from the browser and receive it in a controlled and auditable manner.
User-Agent Client Hints from Chromium 89:
- User-Agent Client Hints have been default enabled in Chrome since version 89.
- By default, the browser returns information about the browser brand, version, platform, and whether it's a mobile device.
User-Agent response and request headers:
- The value of User-Agent may be blank, not returned, or populated with a varying value due to privacy and compatibility considerations.
- The User-Agent information can also be accessed in JavaScript through the navigator.userAgentData object.
Example exchange:
- A typical exchange between the browser and server involves the browser requesting a page and the server responding with data and requesting additional information.
- The browser grants the server access to the additional information in subsequent requests.
JavaScript API:
- The User-Agent information can be accessed in JavaScript through the navigator.userAgentData object.
- Additional values can be retrieved using the getHighEntropyValues() method.
Privacy and compatibility considerations:
- User-Agent Client Hints are only sent over secure connections.
- The value of User-Agent may not always be available or consistent, and developers should account for this in their code.
Hint life-time and resetting:
- Hints specified via the Accept-CH header will be sent for the duration of the browser session or until a different set of hints are specified.
- If another Accept-CH header is received, it will completely replace the current hints being sent.
Hint scope and cross-origin requests:
- By default, Client Hints will only be sent on same-origin requests.
- To allow hints on cross-origin requests, each hint and origin must be specified by a Permissions-Policy header.
Where to use User-Agent Client Hints?:
- Refactor any instances where you are parsing the User-Agent header or using JavaScript calls to access the information.
- Re-examine your use of User-Agent information and replace it with other methods whenever possible.
What happens to the User-Agent string?:
- The plan is to minimize the ability for covert tracking on the web by reducing the amount of identifying information exposed by the existing User-Agent string.
- User-Agent Client Hints will eventually reduce the information in the User-Agent string while providing the same high-level browser and version information.
Summary:
- Accept-CH header specifies hints to be sent by the browser.
- Hints persist until a different set is specified or the browser is closed.
- Cross-origin requests require Permissions-Policy header to allow hints.
- Refactor code to use User-Agent Client Hints instead of parsing User-Agent header.
- User-Agent string will eventually be reduced to minimize tracking.