627942 - XmlHttpRequest::setRequestHeader("User-Agent", ...) fails to override internal Firefox user-agent string

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect)

Description

[firefox]

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.13) Gecko/20101206 Ubuntu/10.04 (lucid) Firefox/3.6.13
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.13) Gecko/20101206 Ubuntu/10.04 (lucid) Firefox/3.6.13

When setting a user agent string with XMLHttpRequest::setRequestHeader() for a given request session, setting "User-Agent" header seems to be ignored.

NOTE: If the internal user agent string is changed in about:config, the changed user-agent string IS sent for XHR requests.

But if the XHR tries to set the user-agent itself with setRequestHeader(), it has no effect -- the current internal Firefox user-agent string is sent instead.

Reproducible: Always

Steps to Reproduce:
To see a repro, visit http://pcdespair.com/checkua.php to view a script the sends an XHR to a PHP script that just echos back the contents of the User-Agent header received at the server.

The relevant code is:

            XmlHttp = new XMLHttpRequest();

            XmlHttp.open("GET", "dumpua.php", true);

            XmlHttp.setRequestHeader('User-Agent',"XHR User-Agent Override");



Actual Results:  
On versions of Firefox prior to 3.6.13, the user agent string displayed by the server is the same string being set by setRequestHeader() above.  In Firefox 3.6.13, it no longer passes that header, but instead passes the current user agent string set in Firefox itself.

Expected Results:  
The server should get the user agent string set by setRequestHeader().

Firefox 3.6.13 should be setting the "User-Agent" header to the value specified in the call to setRequestHeader() above.

Comment 1

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

This is invalid: <http://dev.w3.org/2006/webapi/XMLHttpRequest-2/#dom-xmlhttprequest-setrequestheader>

Comment 2

[Jack Walters]

I would have to disagree that this is invalid.  Maybe changed, but not invalid.

Comment 3

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

It is invalid, because the specification explicitly calls for our behaviour. If you believe the specification is wrong, its "Status of this Document" section explains how to send feedback.

Comment 4

[firefox]

How could revoking the freedom to identify an AJAX app's user agent properly be considered valid?  That makes no sense in Open Source.

I can set any user agent I want in other scripting languages.  Where would the justification come from to revoke proper identification of XHR clients?  To ID the request to the container is a lie...

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

This has nothing to do with open source, but implementing specifications.
As Ms2ger explained, XMLHttpRequest level 2 clearly states that 
User-Agent cannot be set using setRequestHeader.

Of course you're free to take Firefox source code, change it to allow setting
User-Agent. But after that it wouldn't be compatible with XMLHttpRequest
specification.

Comment 6

[firefox]

Okay, we'll drop AJAX and look for alternatives that are not caving to propriety.