1973894 - Firefox doesn't send the sec-ch-ua HTTP header

Status: NEW

(Core :: Networking: HTTP, task, P2)

Description

[Daniel Holbert [:dholbert]]

Firefox doesn't send the Sec-CH-UA header as part of HTTPS requests.

This seems to be needed (maybe for no good reason) in order to get functional results on bug 1972496. In that bug, the website doesn't send the access-control-allow-origin header as part of its response unless the request includes a value for sec-ch-ua (e.g. just adding
-H 'sec-ch-ua: ""' to the curl version of Firefox's fetch request there is sufficient to get e.g. access-control-allow-origin: https://terminal.us-west-1.run.claw.cloud in the response headers, which is needed for the site to work.)

Hence, filing this bug on considering adding support for this Sec-CH-UA header (perhaps optional or site-specific if we're not sure we want to broadly support it yet).

MDN page: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-CH-UA
One WPT test at least: https://wpt.fyi/results/client-hints/sec-ch-ua.https.html

Comment 1

[Daniel Holbert [:dholbert]]

Per MDN, it looks like Chromium-based browsers send this header, but Firefox and Safari do not.

Comment 2

[Sunil Mayya]

This seems pretty straightforward to implement. Placing it in priority new to decide on the urgency to implement this.

Comment 3

[Jan Brasna [:janbrasna]]

I'm not entirely sure there is exactly will to implement the UA hints per se: https://github.com/mozilla/standards-positions/issues/202

(Maybe this could track some form of a feature "stub" to achieve compatibility, or provide dummy/frozen values?)