115773 - navigator.appVersion doesn't change when spoofing useragent

Status: RESOLVED WONTFIX

(Core :: Networking: HTTP, enhancement)

Description

[Stefan Berglund]

Reproducible: Every time
Browser: Mozilla/5.0 (X11; U; SunOS sun4u; en-US; rv:0.9.6+) Gecko/20011214.
Build ID: 2001121410

* Description:
The appversion remains the same after change of useragent and there doesn't 
seem to be a preference setting to set it to a value that matches the useragent 
string.
This is needed as some sites checks navigator.appVersion and denies access if it
isn't within their spec. For example:
https://disp.sebank.se/cgi-bin/ptslogin/wow/wo10.c1001.f001
which should render a login screen but as of now shows a "upgrade your browser"
page.

* Reproduce with:
In user.js set
user_pref("general.useragent.override", "Mozilla/4.76 [en] (X11; U; SunOS 5.8
sun4u; Nav)");

Run the javascript code:
document.write("navigator.userAgent " + navigator.userAgent + "<BR>");
document.write("navigator.appVersion " + navigator.appVersion + "<BR>");

Or go to:
http://www.mozilla.org/docs/web-developer/sniffer/browser_type.html
Check the reported useragent and appversion 2/3 down the page.

* Actual result:
navigator.userAgent Mozilla/4.76 [en] (X11; U; SunOS 5.8 sun4u; Nav)
navigator.appVersion 5.0 (X11; en-US)

* Expected result:
navigator.userAgent Mozilla/4.76 [en] (X11; U; SunOS 5.8 sun4u; Nav)
* If it should mimic netscape 4.76:
navigator.appVersion 4.76 [en] (X11; U; SunOS 5.8 sun4u; Nav)
* The mozilla variant is probably also OK:
navigator.appVersion 4.76 (X11; en-US)

The same results can be obtained if you look at the httpheaders via a cgiscript.

The best solution from my point of view is to be able to set the appversion
string in the same manner as the useragent, otherwise mozilla must know about
the mapping between useragent-string and appversion-string for every browser.
It would be nice if it is also possible to set each part of the useragent 
string and that the appversion and useragent is built from this data, this last
part shouldn't be hard as it seems that only the version number preference is 
left to implement.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Over to networking:http.... (back end code for this lives there)

Comment 2

[Darin Fisher]

-> future

Platform:OS => ALL:ALL

Comment 3

[Ryan Pertusio]

updating summary to be grammatically correct ;)


navigator.appVersion don't change
 ~ to ~
navigator.appVersion doesn't change

Comment 4

[Gordy]

FYI, there are specific parts of www.fidelity.com quotes & research website
where they block mozilla/5.0. For a list of non-blocked browsers goto
http://personal.fidelity.com/global/search/content/system.html#Browsers
This should be a good testing area.

Comment 5

[Ben Basson]

Related bug: http://bugzilla.mozilla.org/show_bug.cgi?id=61071
My take on this issue is that the default should be changed, but the values
should also be spoofable.

Comment 6

[James Lockie]

What is the work-around?

Comment 7

[tyl2]

(In reply to comment #5)
> Related bug: http://bugzilla.mozilla.org/show_bug.cgi?id=61071

In light of that bug, I actually think that this one should be closed. I'm not voting for this anymore. ;-)

Comment 8

[Tony Mechelynck [:tonymec]]

Not only the value returned isn't sensible (bug 61071); it isn't spoofable either (this bug). I'm voting for both.