Closed sanjalijha closed 2 months ago
Hi,
When the User Agent is overridden, for both the new and old modes, Headless Chrome still sends Low Entropy Client Hints.
This is intended behavior, since we don't know how the users override the user-agent, we only send low-entropy client hints to bypass application (e.g. web application firewall) check whether any client hints sent over the head.
When the feature UACHOverrideBlank is enabled, blank headers are sent when the User Agent is overridden. This feature is disabled by default in Headless Chrome (i.e. UACHOverrideBlank=false). Is this behavior intentional? Can the Headless Chrome default behavior be updated to sending blank client hints when the User Agent is overridden (enabling UACHOverrideBlank by default)?
UACHOverrideBlank is disabled by default as intended, the reason why we didn't enabled this feature by default is that: Sending low entropy hints with empty values may cause requests being blocked by web application firewall software, etc.
See context on https://crbug.com/40270800.
Going to close this as intended behavior (but also, this is Chrome-specific, and not really a good fit for the spec's repo).
@Tanych if there is a mismatch between the client hints and the overridden User-Agent header, is that behavior considered working as intended?
@miketaylr what would be a good forum to post these bugs on? Should we move this to bugs.chromium.org?
Headless Chrome, when triggered using the old mode (
--headless
or --headless=old)
, sends 3 Client Hints containing the HeadlessChrome brand. [For eg."Not/A)Brand";v="8", "Chromium";v="126", "HeadlessChrome";v="126"]
. The new headless mode in Chrome, triggered by (--headless=new
), sends Client Hints containing the Google Chrome brand ["Not/A)Brand";v="8", "Chromium";v="126", "Google Chrome";v="126"
].When the User Agent is overridden, for both the new and old modes, Headless Chrome still sends Low Entropy Client Hints.
When the feature
UACHOverrideBlank
is enabled, blank headers are sent when the User Agent is overridden. This feature is disabled by default in Headless Chrome (i.e.UACHOverrideBlank=false
).Is this behavior intentional? Can the Headless Chrome default behavior be updated to sending blank client hints when the User Agent is overridden (enabling
UACHOverrideBlank
by default)? This eliminates the need to validate that the Client Hints and User Agent are consistent when the User Agent is overridden.Command to reproduce the issue -
chrome --headless –dump-dom https://echo.opera.com/ –-user-agent=“hello world”
orchrome --headless=new –dump-dom https://echo.opera.com/ –-user-agent=“hello world”
Output -
GET / HTTP/1.1
Remote: 99.0.82.187 49255
Raw request
Page generated at Wed Apr 24 19:04:25 2024
`