User Agent Parser

User agent strings contain: browser name and version (Chrome 118, Firefox 119, Safari 17), rendering engine (Blink, Gecko, WebKit), operating system and version (Windows 11, macOS 14 Sonoma, Android 14), device type (mobile, tablet, desktop), device manufacturer and model (iPhone 15 Pro, Samsung Galaxy S23), bot/crawler indication (Googlebot, Bingbot). Format follows conventions but not standards - browsers can lie or obfuscate. Modern UAs are complex (100+ characters) to maintain compatibility. Some new UAs are frozen (Chrome on desktop always claims same version to prevent fingerprinting).

User Agent string freezing and Client Hints: Browsers are standardizing UAs to reduce fingerprinting for privacy. Chrome froze desktop UA (always claims same version), uses User-Agent Client Hints (UA-CH) HTTP headers for detailed info when needed. All major browsers include "Mozilla/5.0" for historical compatibility (sites blocked non-Mozilla browsers decades ago). All modern browsers claim "AppleWebKit" and "Chrome" even if not Chrome (for compatibility with sites that only test Chrome). Result: UAs converge on similar strings. Detection now requires: parsing subtle differences, using JavaScript feature detection (preferred), requesting UA-CH headers server-side (modern approach).

Do not rely solely on user agent - can be spoofed, incomplete, or frozen. Best practices: Use CSS media queries for responsive design (@media (max-width: 768px)), check screen size and touch capability in JavaScript (window.innerWidth, "ontouchstart" in window), use User-Agent Client Hints (Sec-CH-UA-Mobile header server-side), combine UA parsing with feature detection. Mobile indicators in UA: "Mobile", "Android", "iPhone", "iPad". Desktop: "Windows NT", "Macintosh", "X11". Edge cases: tablets (may report as desktop), desktop with touch, mobile requesting desktop site. Modern approach: design mobile-first, use responsive layouts, avoid hard device detection when possible.

Yes, easily. User agents are self-reported by browsers and can be changed by: browser extensions, developer tools (Chrome DevTools device emulation), browser settings (Safari allows UA switching), curl/wget --user-agent flag, programming libraries (axios, fetch headers). Why spoof: access mobile/desktop-only sites, avoid bot detection, scraping, privacy (prevent fingerprinting), testing. Implications: never trust UA for security decisions, do not block users based on UA alone, use UA for analytics/optimization not authorization. Detection: combine UA with other signals (screen resolution, touch events, CSS media queries, canvas fingerprinting), use server-side verification (IP reputation, rate limiting, CAPTCHA). User agents are hints, not proof.

Legitimate bots identify themselves clearly: Googlebot: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html), Bingbot: similar pattern with Bingbot identifier, Facebook: facebookexternalhit, Twitter: Twitterbot. Bot indicators: "bot", "crawler", "spider" in UA string, no browser/version info (just user agent name), includes contact URL or email, often includes "compatible" keyword. Verification: reverse DNS lookup of IP (Google IPs resolve to google.com), verify IP against published crawler IP ranges. Bad bots: mimic real browsers (pretend to be Chrome), rapid requests from single IP, no JavaScript execution. Never block bots by UA alone - verify via IP, rate limiting, behavior analysis.

Both have uses. User-Agent string: available immediately client-side (navigator.userAgent), works in all browsers (legacy support), good for basic detection (mobile vs desktop, major browser). User-Agent Client Hints (UA-CH): more accurate device info, reduces passive fingerprinting (privacy), requires server-side request (HTTP headers), not fully supported in all browsers yet (Safari lacks support as of 2026). Best practice: use CSS media queries and feature detection first (most reliable), fallback to UA parsing for analytics/optimization only, implement UA-CH on server for detailed legitimate needs, avoid UA parsing for critical functionality. Modern web prioritizes feature detection over browser sniffing. Use UA parsing for statistics and optimization, not feature availability assumptions.