Comment by olsonjeffery | Hacker News Reader

Comment by olsonjeffery | Hacker News Reader

Parent Full thread

At my employer we are using UserAgent to detect the browser so that we can drive SameSite cookie policy for our various sites (e.g. IE11 and Edge, which we still support, doesn't support SameSite: None).

There are a variety of scenarios where this comes up (e.g. we ship a site that is rendered, by another vendor, within an iframe; so we have to set SameSite: None on our application's session cookie so that it's valid within the iframe, thus allowing AJAX calls originating from within the iframe to work based on our current auth scheme.. BUT only within Chrome 70+, Firefox but NOT IE, Safari, etc).

Just providing this as an example of backend applications needing to deal with browser-specific behavior, since most of the examples cited in other comments are about rendering/css/javascript features on the client and how UserAgent drives that.

The proposed User Agent Client Hints API would replace this: https://wicg.github.io/ua-client-hints/

The User Agent Client Hints API looks like a very early draft. I could not see any proposed timeline for implementation or estimate of when this might become a supported standard.

I would not personally rely on this as a substitute or replacement for User Agent by September (Google Chrome 85).

Going way back to the original iPhone Web Apps session at WWDC in 2007, they specifically cautioned about the problem of sniffing UA strings.

Of course, the reality of the web meant they had to do a bunch of compatibility hacks to get pages to display well.

(Gecko appeared in the original Safari on iPhone UA, IIRC)

The good news on that front is that IE11 and non-Chromium versions of Edge will likely never stop supporting UserAgent

We are in the same boat. Certain browser/OS combinations don't handle Same-Site correctly, so we are using UA sniffing to work around their limitations by altering Same-Site cookie directives for those browsers. We will likely have to look at some other mechanism for dealing with nonconforming Same-Site behavior.

Reply on news.ycombinator.com