92716 - Need way to completely disable user-agent header

Status: RESOLVED WORKSFORME

(Core :: Networking: HTTP, enhancement, P4)

Description

[Jeremy M. Dolan]

Preferably under the main Privacy & Security tab, right next to the UI to
disable Referer:  (see bug 55477)

Comment 1

[Jeremy M. Dolan]

adding to junkbuster tracker

Comment 2

[Christopher Aillon (sabbatical, not receiving bugmail)]

This is more related to Bug 46029 and Bug 80658.

Comment 3

[Ben Bucksch (:BenB)]

See bug 57555 and bug 55366.

Also see my warnings (sites might not work) in bug 46029.

Comment 4

[benc]

We already offer some customization of the UA string. Is this a UI-type request
(make it easy to do...) or is there some aspect of UA that needs to be addressed?
 

Comment 5

[John Taylor]

retargeting. 

mstoltz: this may be your bucket. take it is you want it.

Comment 6

[Mitchell Stoltz (not reading bugmail)]

Not precisely my bucket, but this should be part of the "paranoid mode" I've got
planned - a single pref that enables super-privacy at the cost of breaking a few
sites. I suppose we actually want to allow not sending the useragent header at
all; someone in Necko probably knows how to do that.

Comment 7

[Ben Bucksch (:BenB)]

> We already offer some customization of the UA string. Is this a UI-type request
> (make it easy to do...) or is there some aspect of UA that needs to be
> addressed?

We can customize what appears in the UA-string, but we cannot suppress it
altogether. This bug is about that option.

Comment 8

[benc]

Didn't know how much anonymity is wanted.

I guess I would hide as IE 5, but I can see others want more...

Comment 9

[Jeremy M. Dolan]

Er... hiding as IE is more of a way to get around
this-page-only-works-after-paying-microsoft-tax issue, not a privacy one.

Besides, the last thing we need is to add to IE's 90-some-percent share in
access logs.

Comment 10

[a_geek]

I need to control which headers are sent where. For example (w/o using a
_sophisticated_ firewall): I need to block all referers when crossing from
inside (intranet) to outside (internet) in order to avoid data leakage.
These links are eg. on pages I maintain or generate them locally, and if
local users click them, usually there would be a referer sent revealing
a link within the intranet, complete with server ip and possibly parameters
(data) used in the application(s). (I'd allow referers when surfing the
Internet or surfing the Intranet, however, only not when crossing this border).

Finer control about headers is desirable, eg. to generally allow session
cookies, but to disallow long-lived cookies etc etc. also, a tool to inspect
the headers sent by the server could be very interesting.

Thank you!

Comment 11

[Ben Bucksch (:BenB)]

I don't think that a general solution is feasible. (You can completely disable
referer already, btw.)

Comment 12

[Jeremy M. Dolan]

We really shouldn't need another pref for this. Just don't send UA: at all if
general.useragent.override is set to null. I'm changing my UI request. It should
be under Debug->Networking, by accept encoding/http version. The reason for UI
at all is it's handy to change temporarily to get into a certain MS-only site.
This should take 20 mins tops for someone to implement who knows what they're
doing... I hate to see it futured.

Comment 13

[Hixie (not reading bugmail)]

IMHO, in the interests of simple UI, this should either be:
   1. A debug-panel pref
   2. A duplicate of bug 80658
   3. WONTFIXed.

Comment 14

[Doug Turner (:dougt)]

moving neeti's futured bugs for triaging.

Comment 15

[Tony Mechelynck [:tonymec]]

In reply to comment #12

Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9pre) Gecko/2008033001 SeaMonkey/2.0a1pre

Setting general.useragent.override to empty (but defined) now suppresses the sending of an HTTP_USER_AGENT header, as found by browsing to http://gemal.dk/browserspy/headers.php . It also removes the "Build Identifier" (i.e., UA) line on the about: page.

By installing the UserAgent Switcher extension and defining one additional UA string (value ""), you can get this as a menu item in the "Tools -> UserAgent Switcher" menu.

Resolving WORKSFORME (after approx. 5½ years without a comment). If you REOPEN, please explain why.