gorhill / httpswitchboard

Point & click to forbid/allow any class of requests made by your browser. Use it to block scripts, iframes, ads, facebook, etc.
GNU General Public License v3.0
1.33k stars 83 forks source link

Spoofed userAgent detection using navigator.platform #409

Closed MrChrisW closed 9 years ago

MrChrisW commented 9 years ago
alert(navigator.userAgent.indexOf(navigator.platform) > -1);

The above will return false if the navigator.platform is not found within the navigator.userAgent string.

Obviously some tweaking would be needed to make a reliable detection method. There are a wide variety of both platform strings and userAgent strings however generally the platform string is included in full or partially in the userAgent string. Making the detection of a spoofed userAgent easy.

Can HTTPSB spoof the navigator.platform string (contentscript-start.js) as well as the userAgent string?

I'd love to detect the platform from the userAgent string (provided by the user) however that would be tricky and require a pre-build list of acceptable platforms (Windows, Linux), maybe it can be added as another option like the userAgent spoofing (users can enter their own strings)?

Thanks