0

Is there a simple way to specify the UA string for a particular http request, frame or iFrame within a single page?

For example, the main request to the server would come from...

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7) AppleWebKit/534.48.3 (KHTML, like Gecko) Version/5.1 Safari/534.48.3

and a second request, whether to the originating (your) or another (XSS), from an iFrame or XHR, etc. would identify itself as 

Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_2_1 like Mac OS X) AppleWebKit/533.17.9 (KHTML, like Gecko) Version/5.0.2 Mobile/8C148a Safari/6533.18.5

I realize this is possible via myriad a proxy mechanism... but all such solutions involve convoluted session and cookie manipulation, etc.. Is this possible from a direct page-authorer's perspective and toolbox (ie. JS, page headers, even server configs, etc?)

Alex Gray
  • 16,007
  • 9
  • 96
  • 118
  • I think I sorta answered my own question in a [response to this question](http://stackoverflow.com/questions/5426899/creating-a-proxy-to-spoof-iphone-user-agent-in-php/6630823#6630823) "You could use a PHP class, such as Ben Alman's Simple PHP Proxy.. It let's you redirect cross-domain URL's in a variety of ways, including the following method to "change up" your User Agent...." – Alex Gray Jul 28 '11 at 21:08

2 Answers2

0

No, a web page cannot change what user agent the browser sends. The exception to this is if you use flash to make requests. Then it'll use flash's user agent.

Sid
  • 2,136
  • 1
  • 11
  • 10
0

It is possible to change the user-agent when you are using JS to send requests. Note that it is generally not a good idea to change it, as firewalls / load balancers might get confused if an authenticated user suddenly changes user-agent string, and might consider it a session injection attack...

gggeek
  • 1
  • gggeek, how do you do that? Please answer my question: http://stackoverflow.com/questions/6995311/how-to-spoof-the-user-agent-in-a-get-request-using-javascript – XP1 Aug 09 '11 at 11:24