Editing User-Agent header (section)

== Use in client requests{{anchor|User agent identification}}== <!-- Courtesy note per [[WP:RSECT]]: [[User agent identification]] and several other redirects used to link here.  Please consider the impact of off-site links as well. -->

When a software agent operates in a network protocol, it often identifies itself, its application type, [[operating system]], device model, software vendor, or software revision, by submitting a characteristic identification [[string (computer science)|string]] to its operating peer. In HTTP,<ref name="rfc9110">{{cite web |title=RFC-9110: HTTP Semantics |url=https://www.rfc-editor.org/rfc/rfc9110.html |publisher=IETF |access-date=28 July 2022}}</ref> SIP,<ref name="rfc3261">RFC 3261, ''SIP: Session Initiation Protocol'', IETF, The Internet Society (2002)</ref> and NNTP<ref>{{cite IETF |title=Netnews Article Format |rfc=5536 |section=3.2.13 |date=November 2009 |publisher=[[Internet Engineering Task Force|IETF]]}}</ref> protocols, this identification is transmitted in a header field ''User-Agent''. [[Internet bot|Bot]]s, such as Web crawlers, often also include a [[Uniform Resource Locator|URL]] and/or [[e-mail address]] so that the [[Webmaster]] can contact the operator of the bot.

In HTTP, the "user agent string" is often used for [[content negotiation]], where the origin server selects suitable content or operating parameters for the response. For example, the user agent string might be used by a web server to choose variants based on the known capabilities of a particular version of client software. The concept of content tailoring is built into the HTTP standard in [https://tools.ietf.org/html/rfc1945#page-46 RFC 1945] "for the sake of tailoring responses to avoid particular user agent limitations".

The user agent string is one of the criteria by which Web crawlers may be excluded from accessing certain parts of a website using the [[Robots Exclusion Standard]] (''robots.txt'' file).

As with many other HTTP request headers, the information in the user agent string contributes to the information that the client sends to the server, since the string can vary considerably from user to user.<ref>{{cite web |first=Peter |last=Eckersley |url=https://www.eff.org/deeplinks/2010/01/tracking-by-user-agent |title=Browser Versions Carry 10.5 Bits of Identifying Information on Average |publisher=[[Electronic Frontier Foundation]] |date=27 January 2010 |access-date=25 August 2011}}</ref>

=== Format for human-operated web browsers ===

The user agent string format is currently specified by section 10.1.5 of [https://www.rfc-editor.org/rfc/rfc9110.html#name-user-agent HTTP Semantics]. The format of the user agent string in HTTP is a list of product tokens (keywords) with optional comments. For example, if a user's product were called WikiBrowser, their user agent string might be ''WikiBrowser/1.0 Gecko/1.0''. The "most important" product component is listed first.

The parts of this string are as follows:

* product name and version (''WikiBrowser/1.0'')
* layout engine and version (''Gecko/1.0'')

During the first [[browser wars|browser war]], many web servers were configured to send web pages that required advanced features, including [[Framing (World Wide Web)|frames]], to clients that were identified as some version of [[Mozilla]] only.<ref>[http://webaim.org/blog/user-agent-string-history/ History of the browser user-agent string]. WebAIM.</ref> Other browsers were considered to be older products such as [[Mosaic (web browser)|Mosaic]], [[Cello (web browser)|Cello]], or [[Samba (web browser)|Samba]], and would be sent a bare bones HTML document.

For this reason, most Web browsers use a user agent string value as follows:

{{block indent|Mozilla/[''version''] ([''system and browser information'']) [''platform''] ([''platform details'']) [''extensions'']}}

For example, Safari on the iPad has used the following:

 Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405

The components of this string are as follows:

* ''Mozilla/5.0'': Previously used to indicate compatibility with the Mozilla rendering engine.
* ''(iPad; U; CPU OS 3_2_1 like Mac OS X; en-us)'': Details of the system in which the browser is running.
* ''AppleWebKit/531.21.10'': The platform the browser uses.
* ''(KHTML, like Gecko)'': Browser platform details.
* ''Mobile/7B405'': This is used by the browser to indicate specific enhancements that are available directly in the browser or through third parties. An example of this is Microsoft Live Meeting which registers an extension so that the Live Meeting service knows if the software is already installed, which means it can provide a streamlined experience to joining meetings.

Before migrating to the [[Chromium (web browser)|Chromium]] code base, [[Opera (web browser)|Opera]] was the most widely used web browser that did not have the user agent string with "Mozilla" (instead beginning it with "Opera"). Since July 15, 2013,<ref>{{cite web|url=http://my.opera.com/ODIN/blog/2013/07/15/opera-user-agent-strings-opera-15-and-beyond |title=Opera User Agent Strings: Opera 15 and Beyond |publisher=dev.opera.com |date=15 July 2013 |access-date=2014-05-05}}</ref> Opera's user agent string begins with "Mozilla/5.0" and, to avoid encountering legacy server rules, no longer includes the word "Opera" (instead using the string "OPR" to denote the Opera version).

=== Format for automated agents (bots) ===

Automated web crawling tools can use a simplified form, where an important field is contact information in case of problems. By convention the word "bot" is included in the name of the agent. For example:

 <nowiki>Googlebot/2.1 (+http://www.google.com/bot.html)</nowiki>

Automated agents are expected to follow rules in a special file called "[[robots.txt]]".

=== Encryption strength notations ===

Web browsers created in the United States, such as [[Netscape Navigator]] and [[Internet Explorer]], previously used the letters U, I, and N to specify the [[encryption]] strength in the user agent string. Until 1996, when the United States government allowed encryption with keys longer than 40 bits to be exported, vendors shipped various browser versions with different encryption strengths. "U" stands for "USA" (for the version with 128-bit encryption), "I" stands for "International"{{snd}} the browser has 40-bit encryption and can be used anywhere in the world{{snd}} and "N" stands (''de facto'') for "None" (no encryption).<ref name=zawinski-old>{{cite web
| url = https://www-archive.mozilla.org/build/user-agent-strings.html
| title = user-agent strings (obsolete)
| first = Jamie
| last = Zawinski
| date = 28 March 1998
| access-date = 2010-01-08
| publisher = mozilla.org
}}</ref> Following the lifting of [[export of cryptography in the United States#PC era|export restrictions]], most vendors supported 256-bit encryption.