Bug 1918009 Comment 3 Edit History

Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.

Original comment by
on 
This is the HTTP header, not JS. Note: we want to remove the HTTP header spoofing as windows on linux and mac upstrteam (dropped in Mullvad Browser [last cycle](https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/issues/234)), and aligned in [Tor Browser 14](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42467) - also note cloudflare notified (so I expect mismatched headers to become more of an issue?) - see Bug 1826098

```
RFP on examples (windows 11: note version is hardcoded capped at 10)
- `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0` - JS/navigator
- `Mozilla/5.0 (Windows NT 10.0; rv:130.0) Gecko/20100101 Firefox/130.0` - HTTP header

RFP off
- `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0` - JS/navigator
- `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0` - HTTP header
```

So...
1. drop spoofing as two OSes and only limit to 4 results in HTTP headers (we still protect values in the string)
2. align the HTTP header and JS navigator to be the same

ni :morgan for input
Revision 1 by
on 
This is the HTTP header, not JS. Note: we want to remove the HTTP header spoofing as windows on linux and mac upstrteam (dropped in Mullvad Browser [last cycle](https://gitlab.torproject.org/tpo/applications/mullvad-browser/-/issues/234)), and aligned in [Tor Browser 14](https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42467) - also note cloudflare notified (so I expect mismatched headers to become more of an issue?) - see Bug 1826098

```
RFP on examples (windows 11: note version is hardcoded capped at 10)
- `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0` - JS/navigator
- `Mozilla/5.0 (Windows NT 10.0; rv:130.0) Gecko/20100101 Firefox/130.0` - HTTP header

RFP off
- `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0` - JS/navigator
- `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0` - HTTP header
```

So...
1. drop spoofing as two OSes and only limit to 4 results in HTTP headers (we still protect values in the string)
2. align the HTTP header and JS navigator to be the same

ni :morgan for input

edit: test page that compares the two: https://canvasblocker.kkapsner.de/test/navigatorTest.php

Back to Bug 1918009 Comment 3